This issue was posted by codex-tui using gpt-5.6-sol on behalf of David.
Maven POM ingestion passes repository-controlled XML directly to xml.etree.ElementTree.fromstring. Unlike the other project XML extractors, it does not reject DTD or entity declarations first.
A POM containing an internal entity expands that entity into the generated package label. External entity resolution was not reproduced, but nested internal entities can consume disproportionate CPU and memory within the existing 2 MiB manifest size cap.
Proposed behavior:
- reject POMs containing
<!DOCTYPE or <!ENTITY before XML parsing;
- preserve ordinary and default-namespaced POM parsing;
- add a regression test for internal-entity input.
The same conservative declaration screen already exists for other project XML inputs in graphify.extract._project_xml_is_safe.
Maven POM ingestion passes repository-controlled XML directly to
xml.etree.ElementTree.fromstring. Unlike the other project XML extractors, it does not reject DTD or entity declarations first.A POM containing an internal entity expands that entity into the generated package label. External entity resolution was not reproduced, but nested internal entities can consume disproportionate CPU and memory within the existing 2 MiB manifest size cap.
Proposed behavior:
<!DOCTYPEor<!ENTITYbefore XML parsing;The same conservative declaration screen already exists for other project XML inputs in
graphify.extract._project_xml_is_safe.