[somiljain2006]

Fixes #4216

Fix XXE vulnerability in ProcessDiagramLayoutFactory by securely configuring the XML parser to reject DOCTYPE declarations, disable external entity and DTD resolution, disable XInclude and entity expansion, and add regression coverage for malicious BPMN XML. Apply the same hardening to the Flowable 5 compatibility parser.

Checklist:

• Unit tests: YES
• Documentation: NA

[360608]

Thanks for working on this. I verified the parser hardening independently: with the patch, an XXE payload is rejected and valid BPMN with DI still parses.

One concern about the test: it puts the entity in an attribute value (id="&xxe;"). The JDK rejects that on the unpatched parser too, so the test passes without the fix. To make it a real regression test, place the entity in element text content, e.g. <documentation>&xxe;</documentation> with <!DOCTYPE definitions [<!ENTITY xxe SYSTEM "file:///...">]>. Unpatched, the file contents are resolved into the model; patched, parsing fails on the DOCTYPE.

@somiljain2006 I opened a PR against your branch with a stronger test that does this (plus DOCTYPE-rejected and valid-BPMN-parses cases): somiljain2006#1

Also, could a maintainer merge this and cut a patch release? Issue #4216 is flagged HIGH by dependency scanners (CVE-2026-91197), and 8.0.0 is the latest release, so downstream users have no fixed version to move to.

[360608]

@dbmalkovsky @filiphr @tijsrademakers @jbarrez - could you please review this fix and, if it looks good, merge it and include it in a patch release (8.0.1)?

• It closes XML External Entity (XXE) injection in ProcessDiagramLayoutFactory #4216 (XXE in ProcessDiagramLayoutFactory, CVE-2026-91197), which scanners now flag as HIGH. 8.0.0 is the latest release, so affected users have no fixed version to upgrade to.
• The change is a small parser-hardening patch (DOCTYPE and external entities disabled) in flowable-engine and flowable5-engine, with no API changes.
• I checked it independently: the hardened parser rejects the XXE payload and still parses valid BPMN with DI.
• The existing test passes even without the fix; Strengthen XXE regression test (entity in element text) somiljain2006/flowable-engine#1 strengthens it so it actually fails on vulnerable code.

Several enterprise users are waiting on a patched release to clear security reviews. Thank you!