Java: `java/xxe` doesn't cover public XML helper methods that parse caller-provided input

Beginne mit der java/xxe-Abfrage und ihrem bestehenden Sink zur Parser-Erstellung sowie der Modellierung der sicheren Konfiguration. Prüfe die Abdeckung für öffentliche Hilfsmethoden, die InputStream-, String-, Reader- oder URL-Werte an DocumentBuilderFactory.parse übergeben, und vergleiche anschließend ähnliche Einstiegspunkte von SAXParserFactory und XMLInputFactory. Als erledigt gilt die Aufgabe, wenn Tests Findings für die beschriebene Form von Hilfsmethoden und triviale Wrapper demonstrieren, ohne bestehende Ergebnisse zu verlieren.

This looks like a gap in java/xxe around library-style XML helpers. If a public helper takes caller-provided XML as an InputStream, String, Reader, or URL, builds a DocumentBuilderFactory without XXE hardening, and then calls newDocumentBuilder().parse(...), I wouldn't expect that to fall out of coverage.

CodeQL already seems to model the parser sink and the usual safe configs here, and it still finds other java/xxe results in the same codebase, so this doesn't look like a missing sink or a failed analysis. It looks more like these public parsing entry points are not treated as strong enough sources for this query. That's a pretty normal pattern in SDK helpers, XML utility classes, metadata loaders, and config parsers, where the trust boundary is the method parameter rather than a controller or request object.

The aws-sdk-android fix for CVE-2022-4725 is a good example: both RegionMetadataParser.parse(InputStream) and XpathUtils.documentFrom(...) were fixed by adding the standard DocumentBuilderFactory hardening.

Semgrep's documentbuilderfactory-disallow-doctype-decl-missing rule catches the same shape by reusing the existing parser-construction sink and checking for missing hardening, which makes this seem like a fairly local modeling issue.

My guess is that java/xxe could cover this by recognizing public parse helpers that feed caller-controlled XML directly, or through trivial wrappers, into the existing XXE sinks. I would expect the same hole to show up for similar helper methods built around SAXParserFactory and XMLInputFactory too.

import java.io.InputStream;
import javax.xml.parsers.DocumentBuilderFactory;

class XmlHelper {
    public static void parse(InputStream in) throws Exception {
        DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
        var b = f.newDocumentBuilder();
        b.parse(in);
    }
}