XML Parsing, GPath & Security

A dotted name selects the child elements with that name, and repeating the step walks down. Because a name can match several siblings, the result is a collection even when one element matches; text() joins the text of everything selected, and *.text() (the spread-dot, see Object Operators) collects the texts one by one. An attribute is read with @name or ['@name']; it returns a String, so convert it when you need a number.

Source: Groovy documentation: GPath

Note the last two lines: price.@currency is one attribute per price element, so text() glues the three values together while size() still counts three. The methods that filter and transform the result (findAll, find, collect, sum) are the ordinary GDK methods described on Working with Collections; inside their closures it is one element.

* is a shortcut for children(): the direct children of the node, whatever their names. ** is a shortcut for depthFirst(): the node and everything under it. Use ** when you know what you are looking for but not where it is, which is what // does in XPath. breadthFirst() selects the same nodes as ** but in a different order.

The two traversals return the same nodes in different orders: depth first descends into a section and its seeds before the next section, while breadth first finishes a level before going down. depthFirst().size() is 21 because the root and every element count; text is not a node. In the two find lines parent() goes one level up, so .parent().name is the name child of the seed that owns that price, and .parent().@id is that seed’s id. On a Node the same expressions work: '**', depthFirst() and breadthFirst() return the element nodes (21 for the catalogue), and attribute('id'), attributes() and @id read attributes.

Source: Groovy documentation: GPath

By default both parsers are namespace aware, but an unqualified name in a GPath expression matches by local name, whatever its namespace. To tell two namespaces apart declare a prefix on the result and use it in the expression, or switch namespace handling off and treat the prefixed name as an ordinary name.

The first expression matched both name elements, which is the trap: a document that mixes vocabularies needs the prefix declarations. declareNamespace takes a map of prefix to URI, and the prefixes you declare are yours, not necessarily the ones the document uses.

Source: Groovy documentation: GPath

Three knobs cover the legitimate cases, and each opts in explicitly. Turn them on only for input you trust.

Allowing the DOCTYPE is a smaller step than it sounds: internal entities work, but the external one is still refused because the JDK’s secure-processing limits stay on, and the expansion bomb still fails once the parser exceeds its entity-expansion limit (the default of 2500 shown in the message). Only a resolver you write can return content for an external reference, and here it returns a constant string. The resolver receives the systemId the document asked for, which is the place to accept a known name and reject everything else.

The default is itself a change to be aware of: before 6.0 these parsers accepted a DOCTYPE and bare JDK factories were returned by the helper methods, so an application that parsed documents with a DTD needs allowDocTypeDeclaration: true after upgrading. See What’s New & Migrating from Older Versions.

Source: Groovy documentation: Relaxing when you need to

When you go below Groovy’s APIs and use JAXP directly, groovy.xml.FactorySupport returns factories that already carry the hardening recipe: createDocumentBuilderFactory(), createSaxParserFactory(), createXMLInputFactory() (StAX), createTransformerFactory(allowDocType, allowExternal), createSchemaFactory(...) and createXPathFactory(). The overloads that take true allow DOCTYPE. In 6.0 the zero-argument createDocumentBuilderFactory() and createSaxParserFactory() are the hardened ones, where earlier versions returned bare JDK factories.

The documentation recommends verifying that hardening took effect by reading the setting back with getFeature or getProperty, exactly as above, because the individual setFeature calls are wrapped in try/catch blocks.

Source: Groovy documentation: Hardened factories from FactorySupport

XmlParser and XmlSlurper are the right tools for documents that fit in memory. For a very large feed, XmlUtil.streamElements reads the document with StAX and hands you each matching element as a small, complete DOM node, so memory is bounded by one record. XmlUtil.events gives the raw javax.xml.stream.events.XMLEvent stream over a hardened XMLInputFactory.

The event types are the constants of XMLStreamConstants: 7 is the start of the document, 1 a start tag and 4 character data (whitespace between elements). A namespace-qualified overload takes the namespace URI and the local name, and a four-argument overload takes allowDocTypeDeclaration when the feed needs a DTD. The stream is lazy, so it can be consumed on the fly; the official page shows sinking each record into a virtual-thread executor on JDK 21 and later (see Java Virtual Threads). The run above also logged a WARNING from FactorySupport that the Woodstox StAX implementation on the Groovy distribution’s classpath does not recognise the accessExternalSchema property; it is the best-effort behaviour described next.

Source: Groovy documentation: Streaming large XML documents

The helpers that apply the hardening, XmlUtil.setFeatureQuietly and the equivalent code inside FactorySupport, silently ignore a feature the JAXP provider does not know, which is why the warnings above are logged rather than thrown. If you ship a custom JAXP provider that does not implement FEATURE_SECURE_PROCESSING, hardening is best effort and the factory may fall back to the provider’s defaults. On the stock JDK the defaults already block XXE, entity expansion and external resource access.

For the narrow case of a non-JDK provider on the classpath, the documentation suggests optionally adding Apache Commons Secure XML (Groovy does not depend on it), whose floor is that external references resolve to empty content on any provider, and injecting its parser into the Groovy classes: new XmlSlurper(SecureSAXParserFactory.newInstance().newSAXParser()) or new DOMBuilder(SecureDocumentBuilderFactory.newInstance().newDocumentBuilder()). Injection applies only to parsers you construct yourself, since new XmlParser() and XmlUtil keep using Groovy’s own factories, and it bypasses Groovy’s factory configuration, so the element-depth bound jdk.xml.maxElementDepth is yours to set. This was not run here: it needs that library. Likewise SchemaFactory instances from FactorySupport.createSchemaFactory enable secure processing but leave ACCESS_EXTERNAL_SCHEMA unset, so that a schema can import from a trusted location; set it to the empty string if your schemas never import.

Source: Groovy documentation: Notes for advanced users