{"action":"created","comment":{"url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/comments/197451990","pull_request_review_id":131202054,"id":197451990,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDE5NzQ1MTk5MA==","diff_hunk":"@@ -655,4 +657,28 @@ private static QName getQName(String localName, String namespaceUri, String pref\n         }\n         return qname;\n     }\n+\n+    /**\n+     * Create an OMElement from an XML fragment given as a string.\n+     *\n+     * @param xmlFragment the well-formed XML fragment\n+     * @return The OMElement created out of the string XML fragment.\n+     * @throws XMLStreamException\n+     */\n+    public static OMElement stringToOM(String xmlFragment) throws XMLStreamException {\n+        return stringToOM(OMAbstractFactory.getOMFactory(), xmlFragment);\n+    }\n+\n+    /**\n+     * Create an OMElement from an XML fragment given as a string.\n+     *\n+     * @param omFactory the factory used to build the object model\n+     * @param xmlFragment the well-formed XML fragment\n+     * @return The OMElement created out of the string XML fragment.\n+     * @throws XMLStreamException","path":"bvm/ballerina-core/src/main/java/org/ballerinalang/model/util/XMLUtils.java","position":83,"original_position":83,"commit_id":"1a19f921ed91531b321937303b0601dc73ff3c23","original_commit_id":"1a19f921ed91531b321937303b0601dc73ff3c23","user":{"login":"ayomawdb","id":612458,"node_id":"MDQ6VXNlcjYxMjQ1OA==","avatar_url":"https://avatars3.githubusercontent.com/u/612458?v=4","gravatar_id":"","url":"https://api.github.com/users/ayomawdb","html_url":"https://github.com/ayomawdb","followers_url":"https://api.github.com/users/ayomawdb/followers","following_url":"https://api.github.com/users/ayomawdb/following{/other_user}","gists_url":"https://api.github.com/users/ayomawdb/gists{/gist_id}","starred_url":"https://api.github.com/users/ayomawdb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ayomawdb/subscriptions","organizations_url":"https://api.github.com/users/ayomawdb/orgs","repos_url":"https://api.github.com/users/ayomawdb/repos","events_url":"https://api.github.com/users/ayomawdb/events{/privacy}","received_events_url":"https://api.github.com/users/ayomawdb/received_events","type":"User","site_admin":false},"body":"This is from AXIOMUtil [1, which we used before this change (since the AXIOMUtil is not flexible enough, it had to be moved.)  We'll have to dig into AXIOM to get exception details. Will look into that. I'll check and try to improve that. \r\n\r\n[1] https://ws.apache.org/axiom/code-coverage/org.apache.axiom.om.util/AXIOMUtil.java.html ","created_at":"2018-06-22T13:53:02Z","updated_at":"2018-06-22T13:53:03Z","html_url":"https://github.com/ballerina-platform/ballerina-lang/pull/9219#discussion_r197451990","pull_request_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/9219","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/comments/197451990"},"html":{"href":"https://github.com/ballerina-platform/ballerina-lang/pull/9219#discussion_r197451990"},"pull_request":{"href":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/9219"}},"in_reply_to_id":197449734},"pull_request":{"url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/9219","id":196648950,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk2NjQ4OTUw","html_url":"https://github.com/ballerina-platform/ballerina-lang/pull/9219","diff_url":"https://github.com/ballerina-platform/ballerina-lang/pull/9219.diff","patch_url":"https://github.com/ballerina-platform/ballerina-lang/pull/9219.patch","issue_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/issues/9219","number":9219,"state":"open","locked":false,"title":"Improve XML parser security to prevent XXE by default","user":{"login":"ayomawdb","id":612458,"node_id":"MDQ6VXNlcjYxMjQ1OA==","avatar_url":"https://avatars3.githubusercontent.com/u/612458?v=4","gravatar_id":"","url":"https://api.github.com/users/ayomawdb","html_url":"https://github.com/ayomawdb","followers_url":"https://api.github.com/users/ayomawdb/followers","following_url":"https://api.github.com/users/ayomawdb/following{/other_user}","gists_url":"https://api.github.com/users/ayomawdb/gists{/gist_id}","starred_url":"https://api.github.com/users/ayomawdb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ayomawdb/subscriptions","organizations_url":"https://api.github.com/users/ayomawdb/orgs","repos_url":"https://api.github.com/users/ayomawdb/repos","events_url":"https://api.github.com/users/ayomawdb/events{/privacy}","received_events_url":"https://api.github.com/users/ayomawdb/received_events","type":"User","site_admin":false},"body":"## Purpose\r\nThe XML parsing utility of Ballerina currently use the `StAXParserConfiguration.DEFAULT` which allows remote entity inclusion, allowing in security vulnerability XML External Entity (XXE) Processing.  This is number 4 threat in OWASP Top 10 2017 categorization.\r\n\r\n[1] https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing\r\n\r\n## Goals\r\nPrevent possibility of XML External Entity (XXE) Processing by default. \r\n\r\n## Approach\r\nChange the XML parser to use `StAXParserConfiguration.STANDALONE` to make sure the parser is secure by default, and add unit tests and integration tests for XML entity expansion and XML external entity injection attack patterns.\r\n\r\n## Related PRs\r\nThis PR depends on PR #9163 and **unit tests will fail until** the PR #9163 get merged. ","created_at":"2018-06-22T06:33:12Z","updated_at":"2018-06-22T13:53:03Z","closed_at":null,"merged_at":null,"merge_commit_sha":"aad64c4f87bedb7f0ad6764a2c798fd0d04f0091","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/9219/commits","review_comments_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/9219/comments","review_comment_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/comments{/number}","comments_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/issues/9219/comments","statuses_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/statuses/1a19f921ed91531b321937303b0601dc73ff3c23","head":{"label":"ayomawdb:xml-security","ref":"xml-security","sha":"1a19f921ed91531b321937303b0601dc73ff3c23","user":{"login":"ayomawdb","id":612458,"node_id":"MDQ6VXNlcjYxMjQ1OA==","avatar_url":"https://avatars3.githubusercontent.com/u/612458?v=4","gravatar_id":"","url":"https://api.github.com/users/ayomawdb","html_url":"https://github.com/ayomawdb","followers_url":"https://api.github.com/users/ayomawdb/followers","following_url":"https://api.github.com/users/ayomawdb/following{/other_user}","gists_url":"https://api.github.com/users/ayomawdb/gists{/gist_id}","starred_url":"https://api.github.com/users/ayomawdb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ayomawdb/subscriptions","organizations_url":"https://api.github.com/users/ayomawdb/orgs","repos_url":"https://api.github.com/users/ayomawdb/repos","events_url":"https://api.github.com/users/ayomawdb/events{/privacy}","received_events_url":"https://api.github.com/users/ayomawdb/received_events","type":"User","site_admin":false},"repo":{"id":116817916,"node_id":"MDEwOlJlcG9zaXRvcnkxMTY4MTc5MTY=","name":"ballerina","full_name":"ayomawdb/ballerina","owner":{"login":"ayomawdb","id":612458,"node_id":"MDQ6VXNlcjYxMjQ1OA==","avatar_url":"https://avatars3.githubusercontent.com/u/612458?v=4","gravatar_id":"","url":"https://api.github.com/users/ayomawdb","html_url":"https://github.com/ayomawdb","followers_url":"https://api.github.com/users/ayomawdb/followers","following_url":"https://api.github.com/users/ayomawdb/following{/other_user}","gists_url":"https://api.github.com/users/ayomawdb/gists{/gist_id}","starred_url":"https://api.github.com/users/ayomawdb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ayomawdb/subscriptions","organizations_url":"https://api.github.com/users/ayomawdb/orgs","repos_url":"https://api.github.com/users/ayomawdb/repos","events_url":"https://api.github.com/users/ayomawdb/events{/privacy}","received_events_url":"https://api.github.com/users/ayomawdb/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/ayomawdb/ballerina","description":"Ballerina is a new programming language for integration built on a sequence diagram metaphor.","fork":true,"url":"https://api.github.com/repos/ayomawdb/ballerina","forks_url":"https://api.github.com/repos/ayomawdb/ballerina/forks","keys_url":"https://api.github.com/repos/ayomawdb/ballerina/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ayomawdb/ballerina/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ayomawdb/ballerina/teams","hooks_url":"https://api.github.com/repos/ayomawdb/ballerina/hooks","issue_events_url":"https://api.github.com/repos/ayomawdb/ballerina/issues/events{/number}","events_url":"https://api.github.com/repos/ayomawdb/ballerina/events","assignees_url":"https://api.github.com/repos/ayomawdb/ballerina/assignees{/user}","branches_url":"https://api.github.com/repos/ayomawdb/ballerina/branches{/branch}","tags_url":"https://api.github.com/repos/ayomawdb/ballerina/tags","blobs_url":"https://api.github.com/repos/ayomawdb/ballerina/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ayomawdb/ballerina/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ayomawdb/ballerina/git/refs{/sha}","trees_url":"https://api.github.com/repos/ayomawdb/ballerina/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ayomawdb/ballerina/statuses/{sha}","languages_url":"https://api.github.com/repos/ayomawdb/ballerina/languages","stargazers_url":"https://api.github.com/repos/ayomawdb/ballerina/stargazers","contributors_url":"https://api.github.com/repos/ayomawdb/ballerina/contributors","subscribers_url":"https://api.github.com/repos/ayomawdb/ballerina/subscribers","subscription_url":"https://api.github.com/repos/ayomawdb/ballerina/subscription","commits_url":"https://api.github.com/repos/ayomawdb/ballerina/commits{/sha}","git_commits_url":"https://api.github.com/repos/ayomawdb/ballerina/git/commits{/sha}","comments_url":"https://api.github.com/repos/ayomawdb/ballerina/comments{/number}","issue_comment_url":"https://api.github.com/repos/ayomawdb/ballerina/issues/comments{/number}","contents_url":"https://api.github.com/repos/ayomawdb/ballerina/contents/{+path}","compare_url":"https://api.github.com/repos/ayomawdb/ballerina/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ayomawdb/ballerina/merges","archive_url":"https://api.github.com/repos/ayomawdb/ballerina/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ayomawdb/ballerina/downloads","issues_url":"https://api.github.com/repos/ayomawdb/ballerina/issues{/number}","pulls_url":"https://api.github.com/repos/ayomawdb/ballerina/pulls{/number}","milestones_url":"https://api.github.com/repos/ayomawdb/ballerina/milestones{/number}","notifications_url":"https://api.github.com/repos/ayomawdb/ballerina/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ayomawdb/ballerina/labels{/name}","releases_url":"https://api.github.com/repos/ayomawdb/ballerina/releases{/id}","deployments_url":"https://api.github.com/repos/ayomawdb/ballerina/deployments","created_at":"2018-01-09T13:13:12Z","updated_at":"2018-06-22T09:08:31Z","pushed_at":"2018-06-22T09:09:14Z","git_url":"git://github.com/ayomawdb/ballerina.git","ssh_url":"git@github.com:ayomawdb/ballerina.git","clone_url":"https://github.com/ayomawdb/ballerina.git","svn_url":"https://github.com/ayomawdb/ballerina","homepage":"","size":234474,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"ballerina-platform:master","ref":"master","sha":"b42d1650fc80368e80eabb8a6dc2bd2d9a13b5a7","user":{"login":"ballerina-platform","id":34733518,"node_id":"MDEyOk9yZ2FuaXphdGlvbjM0NzMzNTE4","avatar_url":"https://avatars2.githubusercontent.com/u/34733518?v=4","gravatar_id":"","url":"https://api.github.com/users/ballerina-platform","html_url":"https://github.com/ballerina-platform","followers_url":"https://api.github.com/users/ballerina-platform/followers","following_url":"https://api.github.com/users/ballerina-platform/following{/other_user}","gists_url":"https://api.github.com/users/ballerina-platform/gists{/gist_id}","starred_url":"https://api.github.com/users/ballerina-platform/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ballerina-platform/subscriptions","organizations_url":"https://api.github.com/users/ballerina-platform/orgs","repos_url":"https://api.github.com/users/ballerina-platform/repos","events_url":"https://api.github.com/users/ballerina-platform/events{/privacy}","received_events_url":"https://api.github.com/users/ballerina-platform/received_events","type":"Organization","site_admin":false},"repo":{"id":73930305,"node_id":"MDEwOlJlcG9zaXRvcnk3MzkzMDMwNQ==","name":"ballerina-lang","full_name":"ballerina-platform/ballerina-lang","owner":{"login":"ballerina-platform","id":34733518,"node_id":"MDEyOk9yZ2FuaXphdGlvbjM0NzMzNTE4","avatar_url":"https://avatars2.githubusercontent.com/u/34733518?v=4","gravatar_id":"","url":"https://api.github.com/users/ballerina-platform","html_url":"https://github.com/ballerina-platform","followers_url":"https://api.github.com/users/ballerina-platform/followers","following_url":"https://api.github.com/users/ballerina-platform/following{/other_user}","gists_url":"https://api.github.com/users/ballerina-platform/gists{/gist_id}","starred_url":"https://api.github.com/users/ballerina-platform/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ballerina-platform/subscriptions","organizations_url":"https://api.github.com/users/ballerina-platform/orgs","repos_url":"https://api.github.com/users/ballerina-platform/repos","events_url":"https://api.github.com/users/ballerina-platform/events{/privacy}","received_events_url":"https://api.github.com/users/ballerina-platform/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ballerina-platform/ballerina-lang","description":"Ballerina is a new programming language for integration built on a sequence diagram metaphor.","fork":false,"url":"https://api.github.com/repos/ballerina-platform/ballerina-lang","forks_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/forks","keys_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/teams","hooks_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/hooks","issue_events_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/issues/events{/number}","events_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/events","assignees_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/assignees{/user}","branches_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/branches{/branch}","tags_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/tags","blobs_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/git/refs{/sha}","trees_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/statuses/{sha}","languages_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/languages","stargazers_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/stargazers","contributors_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/contributors","subscribers_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/subscribers","subscription_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/subscription","commits_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/commits{/sha}","git_commits_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/git/commits{/sha}","comments_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/comments{/number}","issue_comment_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/issues/comments{/number}","contents_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/contents/{+path}","compare_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/merges","archive_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/downloads","issues_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/issues{/number}","pulls_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls{/number}","milestones_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/milestones{/number}","notifications_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/labels{/name}","releases_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/releases{/id}","deployments_url":"https://api.github.com/repos/ballerina-platform/ballerina-lang/deployments","created_at":"2016-11-16T14:58:44Z","updated_at":"2018-06-22T13:10:40Z","pushed_at":"2018-06-22T13:52:43Z","git_url":"git://github.com/ballerina-platform/ballerina-lang.git","ssh_url":"git@github.com:ballerina-platform/ballerina-lang.git","clone_url":"https://github.com/ballerina-platform/ballerina-lang.git","svn_url":"https://github.com/ballerina-platform/ballerina-lang","homepage":"","size":235379,"stargazers_count":643,"watchers_count":643,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":327,"mirror_url":null,"archived":false,"open_issues_count":557,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":327,"open_issues":557,"watchers":643,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/9219"},"html":{"href":"https://github.com/ballerina-platform/ballerina-lang/pull/9219"},"issue":{"href":"https://api.github.com/repos/ballerina-platform/ballerina-lang/issues/9219"},"comments":{"href":"https://api.github.com/repos/ballerina-platform/ballerina-lang/issues/9219/comments"},"review_comments":{"href":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/9219/comments"},"review_comment":{"href":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/ballerina-platform/ballerina-lang/pulls/9219/commits"},"statuses":{"href":"https://api.github.com/repos/ballerina-platform/ballerina-lang/statuses/1a19f921ed91531b321937303b0601dc73ff3c23"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"ayomawdb"}}