SvgUtils.java

package pro.verron.officestamper.utils.svg;

import org.w3c.dom.Document;

import org.xml.sax.SAXException;

import pro.verron.officestamper.utils.UtilsException;

import javax.xml.XMLConstants;

import javax.xml.parsers.DocumentBuilder;

import javax.xml.parsers.DocumentBuilderFactory;

import javax.xml.parsers.ParserConfigurationException;

import java.io.ByteArrayInputStream;

import java.io.IOException;

/// Utility class for working with SVG (Scalable Vector Graphics) documents.

/// Provides methods to parse SVG data securely, mitigating common security risks

/// such as XML External Entity (XXE) attacks.

public class SvgUtils {

        /* This utility class should not be instantiated */

    /// Returns whether SVG parsing safe mode is enabled.

    ///

    /// When enabled (default), the parser is hardened against XXE/DTD and related attacks.

    public static boolean isRestrictedMode() {

    }

    /// Parse an SVG XML document from bytes with hardened XML parser settings.

    ///

    /// - Disables DTDs and external entity resolution to prevent XXE attacks

    /// - Enables secure processing

    /// - Disables XInclude and entity expansion

    ///

    /// @param bytes the SVG content as a UTF-8 encoded byte array

    /// @return the parsed DOM Document

    /// @throws UtilsException if parsing fails or the parser cannot be securely configured

    public static Document parseDocument(byte[] bytes) {

        try {

        }

    }

    private static DocumentBuilder newRestrictedDocumentBuilder()

            throws ParserConfigurationException {

        // Namespace-aware parsing is generally recommended for SVG

        // Harden against XXE/DTD

        // Disallow any DOCTYPE

        // Prevent external entity resolution

        // XInclude and entity expansion

        try {

            // Some implementations may not support XInclude; safe to ignore

    }

    private static DocumentBuilder newPermissiveDocumentBuilder()

            throws ParserConfigurationException {

        // Intentionally avoid setting hardened features; caller opted out of safe mode.

        // Keep entity expansion off to prevent excessive memory usage by default.

        try {

    }

    /// Enables SVG parsing safe mode.

    ///

    /// When safe mode is enabled, the SVG parser applies stricter security configurations to mitigate

    /// potential vulnerabilities, such as XML External Entity (XXE) or Document Type Definition (DTD) attacks.

    ///

    /// This method sets the internal flag to indicate that safe mode is active,

    /// affecting the behavior of SVG parsing methods in this utility class.

    public static void enableSafeMode() {

    /// Disables the safe mode for SVG parsing.

    ///

    /// When safe mode is disabled, the SVG parser applies relaxed security configurations,

    /// which may reintroduce vulnerabilities, such as XML External Entity (XXE) or Document Type Definition (DTD)

    ///  attacks.

    ///

    /// This method sets an internal flag to indicate that the safe mode is inactive,

    /// affecting the behavior of SVG parsing methods in this utility class.

    public static void disableSafeMode() {

}

Mutations

1.1
Location : isRestrictedMode
Killed by : none replaced boolean return with true for pro/verron/officestamper/utils/svg/SvgUtils::isRestrictedMode → SURVIVED Covering tests

2.2
Location : isRestrictedMode
Killed by : none replaced boolean return with false for pro/verron/officestamper/utils/svg/SvgUtils::isRestrictedMode → SURVIVED Covering tests

1.1
Location : newRestrictedDocumentBuilder
Killed by : none removed call to javax/xml/parsers/DocumentBuilderFactory::setFeature → SURVIVED Covering tests

1.1
Location : newRestrictedDocumentBuilder
Killed by : none removed call to javax/xml/parsers/DocumentBuilderFactory::setXIncludeAware → SURVIVED Covering tests

1.1
Location : newRestrictedDocumentBuilder
Killed by : none removed call to javax/xml/parsers/DocumentBuilderFactory::setExpandEntityReferences → SURVIVED Covering tests

1.1
Location : newPermissiveDocumentBuilder
Killed by : none removed call to javax/xml/parsers/DocumentBuilderFactory::setXIncludeAware → SURVIVED Covering tests