From 8dadb52821f21fdfa82d56c3fa21fe7ff8cbde61 Mon Sep 17 00:00:00 2001
From: Josh Eckels <jeckels@labkey.com>
Date: Fri, 7 Aug 2026 17:46:54 -0700
Subject: [PATCH] XXE warning for JAXP (#1467)

## Rationale
We want to avoid introducing new XXE problems in the future.

## Related Pull Requests
- https://github.com/LabKey/platform/pull/7875

## Changes
- IntelliJ warning to prevent use for future non-hardened
SchemaFactories
---
 .idea/inspectionProfiles/Project_Default.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.idea/inspectionProfiles/Project_Default.xml b/.idea/inspectionProfiles/Project_Default.xml
index f4fb258fd6..34e83bce18 100644
--- a/.idea/inspectionProfiles/Project_Default.xml
+++ b/.idea/inspectionProfiles/Project_Default.xml
@@ -165,6 +165,10 @@
       <searchConfiguration name="XMLInputFactory.newInstance()" text="javax.xml.parsers.DocumentBuilderFactory.newInstance()" recursive="true" caseInsensitive="true" type="JAVA" pattern_context="default">
         <constraint name="__context__" within="" contains="" />
       </searchConfiguration>
+      <searchConfiguration name="SchemaFactory.newInstance()" description="XML parsers should always be configured to protect against XXE — use XmlBeansUtil.schemaFactory()" suppressId="SchemaFactory" text="javax.xml.validation.SchemaFactory.newInstance($schemaLanguage$)" recursive="true" caseInsensitive="true" type="JAVA" pattern_context="default">
+        <constraint name="__context__" within="" contains="" />
+        <constraint name="schemaLanguage" minCount="0" maxCount="2147483647" within="" contains="" />
+      </searchConfiguration>
     </inspection_tool>
     <inspection_tool class="SimplifiableIfStatement" enabled="false" level="WARNING" enabled_by_default="false" />
     <inspection_tool class="TestMethodIsPublicVoidNoArg" enabled="true" level="ERROR" enabled_by_default="true" />