Java: update the Commons XML model to the commons-secure-xml 1.0.0 API

The library was renamed from commons-xml to commons-secure-xml: the
org.apache.commons.xml.XmlFactories entry point is replaced by six
per-factory classes in org.apache.commons.xml.secure, whose static
new* methods mirror the JAXP factory entry points and all return
hardened factories.

Assisted-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BiNxFje3KZrioKjQTcBCyk

Author: ppkarwasz

java/ql/lib/change-notes/2026-08-02-apache-commons-secure-xml.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* Factories returned by the Apache Commons Secure XML (`org.apache.commons.xml.secure`) hardening library's `SecureDocumentBuilderFactory`, `SecureSAXParserFactory`, `SecureXMLInputFactory`, `SecureTransformerFactory` and `SecureSchemaFactory` classes are now recognized as safely configured by the XXE query.
+* A new extensible class `SafeXmlFactorySource` was added to `semmle.code.java.security.XmlParsers` for modeling sources of pre-hardened JAXP factories.

java/ql/lib/change-notes/2026-08-02-apache-commons-xml-factories.md

@@ -92,23 +92,31 @@ private module SafeDigesterFlowConfig implements DataFlow::ConfigSig {
 private module SafeDigesterFlow = DataFlow::Global<SafeDigesterFlowConfig>;
 
 /**
- * A call to one of the `org.apache.commons.xml.XmlFactories.newXxxFactory()` methods
- * of the Apache Commons XML library.
+ * A call to one of the static factory methods of the `org.apache.commons.xml.secure`
+ * `SecureXxxFactory` classes of the Apache Commons Secure XML library.
  *
- * Every such method returns a fresh JAXP factory that has already been hardened against
- * XML external entity (XXE) attacks, so any parser created from it is treated as safe.
+ * These methods mirror the JAXP factory entry points (`newInstance`, `newDefaultInstance`,
+ * `newNSInstance`, `newFactory`, ...) and every one of them returns a fresh JAXP factory
+ * that has already been hardened against XML external entity (XXE) attacks, so any parser
+ * created from it is treated as safe.
  *
- * `newXPathFactory` is matched for completeness, but the XXE model has no `XPathFactory`
+ * `SecureXPathFactory` is matched for completeness, but the XXE model has no `XPathFactory`
  * safety chain (the XXE sink for XPath is the document being evaluated, not the factory),
  * so it currently has no effect on XXE results.
  */
-private class CommonsXmlSafeXmlFactory extends SafeXmlFactorySource, MethodCall {
-  CommonsXmlSafeXmlFactory() {
-    this.getMethod().getDeclaringType().hasQualifiedName("org.apache.commons.xml", "XmlFactories") and
+private class CommonsSecureXmlFactory extends SafeXmlFactorySource, MethodCall {
+  CommonsSecureXmlFactory() {
+    this.getMethod()
+        .getDeclaringType()
+        .hasQualifiedName("org.apache.commons.xml.secure",
+          [
+            "SecureDocumentBuilderFactory", "SecureSAXParserFactory", "SecureXMLInputFactory",
+            "SecureTransformerFactory", "SecureSchemaFactory", "SecureXPathFactory"
+          ]) and
     this.getMethod()
         .hasName([
-            "newDocumentBuilderFactory", "newSAXParserFactory", "newXMLInputFactory",
-            "newTransformerFactory", "newSchemaFactory", "newXPathFactory"
+            "newDefaultInstance", "newDefaultNSInstance", "newInstance", "newNSInstance",
+            "newDefaultFactory", "newFactory"
           ])
   }
 }

java/ql/lib/semmle/code/java/frameworks/apache/CommonsXml.qll

@@ -15,49 +15,63 @@
 import org.xml.sax.XMLReader;
 import org.xml.sax.helpers.DefaultHandler;
 
-import org.apache.commons.xml.XmlFactories;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureSAXParserFactory;
+import org.apache.commons.xml.secure.SecureSchemaFactory;
+import org.apache.commons.xml.secure.SecureTransformerFactory;
+import org.apache.commons.xml.secure.SecureXMLInputFactory;
 
-// Every factory returned by `org.apache.commons.xml.XmlFactories` is already hardened against
-// XXE, so the parsers created from them must not be reported.
-public class XmlFactoriesTests {
+// Every factory returned by the `org.apache.commons.xml.secure.SecureXxxFactory` classes is
+// already hardened against XXE, so the parsers created from them must not be reported.
+public class SecureXmlFactoriesTests {
 
   public void hardenedDocumentBuilder(Socket sock) throws Exception {
-    DocumentBuilderFactory factory = XmlFactories.newDocumentBuilderFactory();
+    DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance();
     DocumentBuilder builder = factory.newDocumentBuilder();
     builder.parse(sock.getInputStream()); // safe
   }
 
   public void hardenedDocumentBuilderChained(Socket sock) throws Exception {
-    XmlFactories.newDocumentBuilderFactory().newDocumentBuilder().parse(sock.getInputStream()); // safe
+    SecureDocumentBuilderFactory.newDefaultNSInstance().newDocumentBuilder().parse(sock.getInputStream()); // safe
   }
 
   public void hardenedSaxParser(Socket sock) throws Exception {
-    SAXParserFactory factory = XmlFactories.newSAXParserFactory();
+    SAXParserFactory factory = SecureSAXParserFactory.newInstance();
     SAXParser parser = factory.newSAXParser();
     parser.parse(sock.getInputStream(), new DefaultHandler()); // safe
   }
 
   public void hardenedSaxParserXmlReader(Socket sock) throws Exception {
-    SAXParser parser = XmlFactories.newSAXParserFactory().newSAXParser();
+    SAXParser parser = SecureSAXParserFactory.newNSInstance().newSAXParser();
     XMLReader reader = parser.getXMLReader();
     reader.parse(new org.xml.sax.InputSource(sock.getInputStream())); // safe
   }
 
   public void hardenedXmlInputFactory(Socket sock) throws Exception {
-    XMLInputFactory factory = XmlFactories.newXMLInputFactory();
+    XMLInputFactory factory = SecureXMLInputFactory.newFactory();
     factory.createXMLStreamReader(sock.getInputStream()); // safe
     factory.createXMLEventReader(sock.getInputStream()); // safe
   }
 
+  public void hardenedXmlInputFactoryDefault(Socket sock) throws Exception {
+    XMLInputFactory factory = SecureXMLInputFactory.newDefaultFactory();
+    factory.createXMLStreamReader(sock.getInputStream()); // safe
+  }
+
   public void hardenedTransformer(Socket sock) throws Exception {
-    TransformerFactory tf = XmlFactories.newTransformerFactory();
+    TransformerFactory tf = SecureTransformerFactory.newInstance();
     Transformer transformer = tf.newTransformer();
     transformer.transform(new StreamSource(sock.getInputStream()), null); // safe
     tf.newTransformer(new StreamSource(sock.getInputStream())); // safe
   }
 
+  public void hardenedTransformerDefault(Socket sock) throws Exception {
+    TransformerFactory tf = SecureTransformerFactory.newDefaultInstance();
+    tf.newTransformer(new StreamSource(sock.getInputStream())); // safe
+  }
+
   public void hardenedSchema(Socket sock) throws Exception {
-    SchemaFactory factory = XmlFactories.newSchemaFactory(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+    SchemaFactory factory = SecureSchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
     Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); // safe
   }
 }

…/security/CWE-611/XmlFactoriesTests.java …ity/CWE-611/SecureXmlFactoriesTests.javajava/ql/test/query-tests/security/CWE-611/XmlFactoriesTests.java renamed to java/ql/test/query-tests/security/CWE-611/SecureXmlFactoriesTests.java java/ql/test/query-tests/security/CWE-611/XmlFactoriesTests.java renamed to java/ql/test/query-tests/security/CWE-611/SecureXmlFactoriesTests.java

@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1:${testdir}/../../../stubs/jaxb-api-2.3.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/apache-commons-digester3-3.2:${testdir}/../../../stubs/servlet-api-2.4/:${testdir}/../../../stubs/rundeck-api-java-client-13.2:${testdir}/../../../stubs/springframework-5.8.x/:${testdir}/../../../stubs/mdht-1.2.0/:${testdir}/../../../stubs/woodstox-core-6.4.0:${testdir}/../../../stubs/apache-commons-xml-0.1.0
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/jdom-1.1.3:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/simple-xml-2.7.1:${testdir}/../../../stubs/jaxb-api-2.3.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/apache-commons-digester3-3.2:${testdir}/../../../stubs/servlet-api-2.4/:${testdir}/../../../stubs/rundeck-api-java-client-13.2:${testdir}/../../../stubs/springframework-5.8.x/:${testdir}/../../../stubs/mdht-1.2.0/:${testdir}/../../../stubs/woodstox-core-6.4.0:${testdir}/../../../stubs/apache-commons-secure-xml-1.0.0