Disable external entity resolution in MSV schema factories

[aizu-m]

Reproducer output against main, schema documents carrying external entities:

W3C  : validates <InjectedByExternalEntity/> ? true       <!ENTITY % ext SYSTEM 'file:...'>  %ext;
RNG  : validates <root>LeakedFromLocalFile</root> ? true  <!ENTITY xxe SYSTEM 'file:...'>  <value>&xxe;</value>

Noticed while grepping the tree for SAXParserFactory.newInstance(). Both MSV construction sites apply only setNamespaceAware(true), so entities in a schema document get resolved: BaseSchemaFactory.getSaxFactory(), shared by the W3C and RELAX NG factories, and the W3CMultiSchemaFactory constructor. The RELAX NG case copies the referenced file into the grammar verbatim. The W3C case pulls declarations out of a fetched DTD and applies them.

Neither the Stax2 factory API nor MSV hands the SAX parser back, so a caller has no way to switch this off. That is why the fix sits at the two construction sites.

xs:include / xs:import and externalRef are resolved by MSV itself rather than through entity resolution, so those keep working. Entities declared in an internal subset, and schemas with no DOCTYPE at all, behave as before. Test covers both directions.

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	71.16%	📈 +0.070%
Branches	62.40%	📈 +0.030%

Coverage data generated from JaCoCo test results

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	71.40%	📈 +0.060%
Branches	62.89%	📈 +0.020%

Coverage data generated from JaCoCo test results

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	71.42%	📈 +0.080%
Branches	62.91%	📈 +0.040%

Coverage data generated from JaCoCo test results

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	71.64%	📈 +0.300%
Branches	63.03%	📈 +0.160%

Coverage data generated from JaCoCo test results

[cowtowncoder]

This probably needs to go in 7.3.0 since it may break legitimate use.

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	71.62%	📈 +0.280%
Branches	63.00%	📈 +0.130%

Coverage data generated from JaCoCo test results

[aizu-m]

Agreed, 7.3.0 is the right place. Any schema document that relies on pulling entities from an external file would stop loading with this in, so it shouldn't ride along in a patch release. Saw you moved the notes over already.

[aizu-m]

any update?