CVE-2023-4218: Improper Restriction of XML External Entity Reference (CWE-611)
value: In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 5
Published: 2023-11-09T09:15Z
Repository: https://github.com/eclipse-jdt/eclipse.jdt.core
Language: Java
Files changed: org.eclipse.jdt.apt.core/META-INF/MANIFEST.MF, org.eclipse.jdt.apt.core/src/org/eclipse/jdt/apt/core/internal/util/FactoryPathUtil.java, org.eclipse.jdt.apt.ui/META-INF/MANIFEST.MF, org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLComparer.java, org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLConverter.java, org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/negative/NegativeModelProc.java, org.eclipse.jdt.core.internal.tools/META-INF/MANIFEST.MF, org.eclipse.jdt.core.internal.tools/src/org/eclipse/jdt/core/internal/tools/unicode/TableBuilder.java, org.eclipse.jdt.core.tests.builder/META-INF/MANIFEST.MF, org.eclipse.jdt.core.tests.compiler/META-INF/MANIFEST.MF, org.eclipse.jdt.core.tests.model/META-INF/MANIFEST.MF, org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/formatter/DecodeCodeFormatterPreferences.java, org.eclipse.jdt.core.tests.performance/META-INF/MANIFEST.MF, org.eclipse.jdt.core/META-INF/MANIFEST.MF, org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaModelManager.java, org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaProject.java, org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/UserLibrary.java, org.eclipse.jdt.tests.latestBREE/META-INF/MANIFEST.MF
Commit date: 2023-07-26 16:49:05 +0200
Commit message: Refactor XML parsing
Diff: diff --git a/org.eclipse.jdt.apt.core/META-INF/MANIFEST.MF b/org.eclipse.jdt.apt.core/META-INF/MANIFEST.MF
index e07291e21c..b7e9a340cf 100644
--- a/org.eclipse.jdt.apt.core/META-INF/MANIFEST.MF
+++ b/org.eclipse.jdt.apt.core/META-INF/MANIFEST.MF
@@ -17,11 +17,11 @@ Export-Package: com.sun.mirror.apt,
  org.eclipse.jdt.apt.core.internal.generatedfile;x-friends:="org.eclipse.jdt.apt.pluggable.core,org.eclipse.jdt.apt.tests,org.eclipse.jdt.apt.ui,org.eclipse.jdt.apt.pluggable.tests",
  org.eclipse.jdt.apt.core.internal.type;x-friends:="org.eclipse.jdt.apt.pluggable.core,org.eclipse.jdt.apt.tests,org.eclipse.jdt.apt.ui,org.eclipse.jdt.apt.pluggable.tests",
  org.eclipse.jdt.apt.core.internal.util;x-friends:="org.eclipse.jdt.apt.pluggable.core,org.eclipse.jdt.apt.tests,org.eclipse.jdt.apt.ui,org.eclipse.jdt.apt.pluggable.tests",
  org.eclipse.jdt.apt.core.util
 Require-Bundle: org.eclipse.jdt.core;bundle-version="[3.34.0,4.0.0)",
- org.eclipse.core.runtime;bundle-version="[3.5.100,4.0.0)",
+ org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
  org.eclipse.core.resources;bundle-version="[3.6.0,4.0.0)",
  org.apache.ant;bundle-version="1.6.5"
 Bundle-Activator: org.eclipse.jdt.apt.core.internal.AptPlugin
 Bundle-Vendor: %providerName
 Bundle-RequiredExecutionEnvironment: JavaSE-17
diff --git a/org.eclipse.jdt.apt.core/src/org/eclipse/jdt/apt/core/internal/util/FactoryPathUtil.java b/org.eclipse.jdt.apt.core/src/org/eclipse/jdt/apt/core/internal/util/FactoryPathUtil.java
index ad0e4cb2b1..acbbd114ed 100644
--- a/org.eclipse.jdt.apt.core/src/org/eclipse/jdt/apt/core/internal/util/FactoryPathUtil.java
+++ b/org.eclipse.jdt.apt.core/src/org/eclipse/jdt/apt/core/internal/util/FactoryPathUtil.java
@@ -23,10 +23,11 @@ import java.util.Map;
 
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
+import org.eclipse.core.internal.runtime.XmlProcessorFactory;
 import org.eclipse.core.resources.IFile;
 import org.eclipse.core.resources.IProject;
 import org.eclipse.core.resources.IResource;
 import org.eclipse.core.runtime.CoreException;
 import org.eclipse.core.runtime.IPath;
@@ -219,12 +220,13 @@ public final class FactoryPathUtil {
 		Map<FactoryContainer, FactoryPath.Attributes> result = new LinkedHashMap<>();
 		StringReader reader = new StringReader(xmlFactoryPath);
 		Element fpElement = null;
 
 		try {
-			DocumentBuilder parser =
-				DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			@SuppressWarnings("restriction")
+			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory
+					.createDocumentBuilderWithErrorOnDOCTYPE();
 			fpElement = parser.parse(new InputSource(reader)).getDocumentElement();
 
 		}
 		catch (IOException e) {
 			throw new CoreException(new Status(IStatus.ERROR, AptPlugin.PLUGIN_ID, -1, Messages.FactoryPathUtil_status_ioException, e));
diff --git a/org.eclipse.jdt.apt.ui/META-INF/MANIFEST.MF b/org.eclipse.jdt.apt.ui/META-INF/MANIFEST.MF
index 59036faa5c..404f14b58d 100644
--- a/org.eclipse.jdt.apt.ui/META-INF/MANIFEST.MF
+++ b/org.eclipse.jdt.apt.ui/META-INF/MANIFEST.MF
@@ -7,11 +7,11 @@ Bundle-Activator: org.eclipse.jdt.apt.ui.internal.AptUIPlugin
 Bundle-Localization: plugin
 Require-Bundle: org.eclipse.jdt.apt.core;bundle-version="[3.6.0,4.0.0)",
  org.eclipse.jdt.ui;bundle-version="[3.14.0,4.0.0)",
  org.eclipse.jdt.core;bundle-version="[3.34.0,4.0.0)",
  org.eclipse.ui;bundle-version="[3.5.0,4.0.0)",
- org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
+ org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
  org.eclipse.core.resources;bundle-version="[3.2.0,4.0.0)",
  org.eclipse.ui.forms;bundle-version="[3.2.0,4.0.0)"
 Bundle-ActivationPolicy: lazy
 Bundle-Vendor: %providerName
 Bundle-RequiredExecutionEnvironment: JavaSE-17
diff --git a/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLComparer.java b/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLComparer.java
index e70349ccc7..a7055997fa 100644
--- a/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLComparer.java
+++ b/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLComparer.java
@@ -163,12 +163,11 @@ public class XMLComparer implements IXMLNames {
 			"  </variable-element>\n" +
 			" </type-element>\n" +
 			"</model>\n";
 
 		// create "actual" model
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-		Document actualModel = factory.newDocumentBuilder().newDocument();
+		Document actualModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 		Element modelNode = actualModel.createElement(MODEL_TAG);
 		// primary type
 		Element typeNode = actualModel.createElement(TYPE_ELEMENT_TAG);
 		typeNode.setAttribute(KIND_TAG, "CLASS");
 		typeNode.setAttribute(SNAME_TAG, "A");
@@ -202,11 +201,11 @@ public class XMLComparer implements IXMLNames {
 		modelNode.appendChild(typeNode);
 		actualModel.appendChild(modelNode);
 
 		// load reference model
     	InputSource source = new InputSource(new StringReader(XML_FRAMEWORK_TEST_MODEL));
-        Document expectedModel = factory.newDocumentBuilder().parse(source);
+        Document expectedModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().parse(source);
 
         // compare actual and reference
         ByteArrayOutputStream out = new ByteArrayOutputStream();
         StringBuilder summary = new StringBuilder();
         summary.append("testXMLFramework failed; see console for details.  ");
diff --git a/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLConverter.java b/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLConverter.java
index 81483e9295..0646dce1ae 100644
--- a/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLConverter.java
+++ b/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLConverter.java
@@ -63,11 +63,11 @@ public class XMLConverter extends ElementScanner6<Void, Node> implements IXMLNam
 	 */
 	public static String xmlToString(Document model) {
 		StringWriter s = new StringWriter();
 		DOMSource domSource = new DOMSource(model);
 		StreamResult streamResult = new StreamResult(s);
-		TransformerFactory tf = TransformerFactory.newInstance();
+		TransformerFactory tf = org.eclipse.core.internal.runtime.XmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
 		Transformer serializer;
 		try {
 			serializer = tf.newTransformer();
 			serializer.setOutputProperty(OutputKeys.INDENT, "yes");
 			serializer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount", "1");
@@ -144,12 +144,11 @@ public class XMLConverter extends ElementScanner6<Void, Node> implements IXMLNam
 	 * @param declarations the collection of language elements to convert
 	 * @return an XML document whose root node is named &lt;model&gt;.
 	 * @throws ParserConfigurationException
 	 */
 	public static Document convertModel(Iterable<? extends javax.lang.model.element.Element> declarations) throws ParserConfigurationException {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-		Document model = factory.newDocumentBuilder().newDocument();
+		Document model = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 		org.w3c.dom.Element modelNode = model.createElement(MODEL_TAG);
 
 		XMLConverter converter = new XMLConverter(model);
 		converter.scan(declarations, modelNode);
 		model.appendChild(modelNode);
diff --git a/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/negative/NegativeModelProc.java b/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/negative/NegativeModelProc.java
index 26abf8736b..8ea594d7a5 100644
--- a/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/negative/NegativeModelProc.java
+++ b/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/negative/NegativeModelProc.java
@@ -39,11 +39,10 @@ import javax.lang.model.element.TypeElement;
 import javax.lang.model.element.VariableElement;
 import javax.lang.model.type.DeclaredType;
 import javax.lang.model.type.TypeKind;
 import javax.lang.model.type.TypeMirror;
 import javax.lang.model.util.Elements;
-import javax.xml.parsers.DocumentBuilderFactory;
 
 import org.eclipse.jdt.compiler.apt.tests.processors.base.XMLComparer;
 import org.eclipse.jdt.compiler.apt.tests.processors.base.XMLConverter;
 import org.w3c.dom.Document;
 import org.xml.sax.InputSource;
@@ -842,12 +841,11 @@ public class NegativeModelProc extends AbstractProcessor
 	 */
 	private boolean checkModel(List<TypeElement> rootElements, String expected, String name) throws Exception {
 		Document actualModel = XMLConverter.convertModel(rootElements);
 
     	InputSource source = new InputSource(new StringReader(expected));
-    	DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-        Document expectedModel = factory.newDocumentBuilder().parse(source);
+        Document expectedModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().parse(source);
 
         ByteArrayOutputStream out = new ByteArrayOutputStream();
         StringBuilder summary = new StringBuilder();
         summary.append("Test ").append(name).append(" failed; see console for details.  ");
         boolean success = XMLComparer.compare(actualModel, expectedModel, out, summary, _ignoreJavacBugs);
diff --git a/org.eclipse.jdt.core.internal.tools/META-INF/MANIFEST.MF b/org.eclipse.jdt.core.internal.tools/META-INF/MANIFEST.MF
index c6c3564ec7..bf4ff17df7 100644
--- a/org.eclipse.jdt.core.internal.tools/META-INF/MANIFEST.MF
+++ b/org.eclipse.jdt.core.internal.tools/META-INF/MANIFEST.MF
@@ -4,8 +4,9 @@ Bundle-Name: %fragmentName
 Bundle-SymbolicName: org.eclipse.jdt.core.internal.tools
 Bundle-Version: 1.2.0.qualifier
 Bundle-Vendor: %providerName
 Bundle-RequiredExecutionEnvironment: JavaSE-17
 Export-Package: META-INF.services
-Require-Bundle: org.eclipse.jdt.core.compiler.batch;bundle-version="3.35.0"
+Require-Bundle: org.eclipse.jdt.core.compiler.batch;bundle-version="3.35.0",
+ org.eclipse.core.runtime;bundle-version="3.29.0"
 Automatic-Module-Name: org.eclipse.jdt.core.internal.tools
 
diff --git a/org.eclipse.jdt.core.internal.tools/src/org/eclipse/jdt/core/internal/tools/unicode/TableBuilder.java b/org.eclipse.jdt.core.internal.tools/src/org/eclipse/jdt/core/internal/tools/unicode/TableBuilder.java
index 7fb30e942e..95ebc1b7a1 100644
--- a/org.eclipse.jdt.core.internal.tools/src/org/eclipse/jdt/core/internal/tools/unicode/TableBuilder.java
+++ b/org.eclipse.jdt.core.internal.tools/src/org/eclipse/jdt/core/internal/tools/unicode/TableBuilder.java
@@ -40,15 +40,14 @@ public class TableBuilder {
 			String unicodeDataFileName) throws IOException {
 
 		List<String> result = new ArrayList<>();
 		SAXParser saxParser = null;
 		try {
-			saxParser = SAXParserFactory.newInstance().newSAXParser();
-		} catch (ParserConfigurationException e) {
-			e.printStackTrace();
-			return null;
-		} catch (SAXException e) {
+			@SuppressWarnings("restriction")
+			SAXParser p = org.eclipse.core.internal.runtime.XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
+			saxParser =p;
+		} catch (SAXException | ParserConfigurationException e) {
 			e.printStackTrace();
 			return null;
 		}
 		DefaultHandler defaultHandler = new DefaultHandler() {
 			@Override
diff --git a/org.eclipse.jdt.core.tests.builder/META-INF/MANIFEST.MF b/org.eclipse.jdt.core.tests.builder/META-INF/MANIFEST.MF
index 3721f754d9..c6ca9f31b2 100644
--- a/org.eclipse.jdt.core.tests.builder/META-INF/MANIFEST.MF
+++ b/org.eclipse.jdt.core.tests.builder/META-INF/MANIFEST.MF
@@ -8,11 +8,11 @@ Bundle-Localization: plugin
 Export-Package: org.eclipse.jdt.core.tests.builder
 Require-Bundle: org.junit;bundle-version="3.8.1",
  org.eclipse.jdt.core;bundle-version="[3.34.0,4.0.0)",
  org.eclipse.jdt.core.tests.compiler;bundle-version="[3.4.0,4.0.0)",
  org.eclipse.core.resources;bundle-version="[3.2.0,4.0.0)",
- org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
+ org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
  org.eclipse.test.performance;bundle-version="[3.1.0,4.0.0)",
  org.eclipse.jdt.annotation;bundle-version="[1.1.0,2.0.0)";resolution:=optional,
  org.eclipse.jdt.annotation;bundle-version="[2.0.0,3.0.0)";resolution:=optional
 Bundle-RequiredExecutionEnvironment: JavaSE-17
 Eclipse-BundleShape: dir
diff --git a/org.eclipse.jdt.core.tests.compiler/META-INF/MANIFEST.MF b/org.eclipse.jdt.core.tests.compiler/META-INF/MANIFEST.MF
index 50d4e003b0..4944049029 100644
--- a/org.eclipse.jdt.core.tests.compiler/META-INF/MANIFEST.MF
+++ b/org.eclipse.jdt.core.tests.compiler/META-INF/MANIFEST.MF
@@ -16,11 +16,11 @@ Export-Package: org.eclipse.jdt.core.tests.compiler,
  org.eclipse.jdt.core.tests.runtime,
  org.eclipse.jdt.core.tests.util
 Require-Bundle: org.junit;bundle-version="3.8.1",
  org.eclipse.jdt.debug;bundle-version="[3.2.0,4.0.0)",
  org.eclipse.jdt.core;bundle-version="[3.34.0,4.0.0)",
- org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
+ org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
  org.eclipse.test.performance;bundle-version="[3.10.0,4.0.0)",
  org.eclipse.core.resources;bundle-version="[3.2.0,4.0.0)",
  org.eclipse.jdt.annotation;bundle-version="[1.1.0,2.0.0)";resolution:=optional,
  org.eclipse.jdt.annotation;bundle-version="[2.0.0,3.0.0)";resolution:=optional
 Import-Package: javax.annotation;version="[1.3.0,2.0.0)",
diff --git a/org.eclipse.jdt.core.tests.model/META-INF/MANIFEST.MF b/org.eclipse.jdt.core.tests.model/META-INF/MANIFEST.MF
index b72b34456c..7166634132 100644
--- a/org.eclipse.jdt.core.tests.model/META-INF/MANIFEST.MF
+++ b/org.eclipse.jdt.core.tests.model/META-INF/MANIFEST.MF
@@ -12,11 +12,11 @@ Export-Package: org.eclipse.jdt.core.tests,
  org.eclipse.jdt.core.tests.formatter.comment,
  org.eclipse.jdt.core.tests.model,
  org.eclipse.jdt.core.tests.rewrite.describing,
  org.eclipse.jdt.core.tests.rewrite.modifying
 Require-Bundle: org.eclipse.core.resources;bundle-version="[3.2.0,4.0.0)",
- org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
+ org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
  org.eclipse.jdt.core;bundle-version="[3.34.0,4.0.0)",
  org.junit;bundle-version="3.8.1",
  org.eclipse.test.performance;bundle-version="[3.1.0,4.0.0)",
  org.eclipse.jdt.core.tests.compiler;bundle-version="[3.4.0,4.0.0)",
  org.eclipse.jdt.compiler.apt.tests;bundle-version="[1.0.0,2.0.0)",
diff --git a/org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/formatter/DecodeCodeFormatterPreferences.java b/org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/formatter/DecodeCodeFormatterPreferences.java
index 4fc7d4568b..73e164785e 100644
--- a/org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/formatter/DecodeCodeFormatterPreferences.java
+++ b/org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/formatter/DecodeCodeFormatterPreferences.java
@@ -24,12 +24,12 @@ import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
 
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
+import org.eclipse.core.internal.runtime.XmlProcessorFactory;
 import org.xml.sax.Attributes;
 import org.xml.sax.SAXException;
 import org.xml.sax.helpers.DefaultHandler;
 
 import com.ibm.icu.util.StringTokenizer;
@@ -61,11 +61,11 @@ public class DecodeCodeFormatterPreferences extends DefaultHandler {
 		return null;
 	}
 
 	public static Map decodeCodeFormatterOptions(String fileName, String profileName) {
 		try {
-			SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
+			SAXParser saxParser = XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 			final DecodeCodeFormatterPreferences preferences = new DecodeCodeFormatterPreferences(profileName);
 			saxParser.parse(new File(fileName), preferences);
 			return preferences.getEntries();
 		} catch (ParserConfigurationException e) {
 			e.printStackTrace();
@@ -87,11 +87,11 @@ public class DecodeCodeFormatterPreferences extends DefaultHandler {
 			ZipEntry zipEntry = zipFile.getEntry(zipEntryName);
 			if (zipEntry == null) {
 				return null;
 			}
 			inputStream = new BufferedInputStream(zipFile.getInputStream(zipEntry));
-			SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
+			SAXParser saxParser = XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 			final DecodeCodeFormatterPreferences preferences = new DecodeCodeFormatterPreferences(profileName);
 			saxParser.parse(inputStream, preferences);
 			return preferences.getEntries();
 		} catch (ParserConfigurationException e) {
 			e.printStackTrace();
diff --git a/org.eclipse.jdt.core.tests.performance/META-INF/MANIFEST.MF b/org.eclipse.jdt.core.tests.performance/META-INF/MANIFEST.MF
index 069d6d2e05..ee2383389c 100644
--- a/org.eclipse.jdt.core.tests.performance/META-INF/MANIFEST.MF
+++ b/org.eclipse.jdt.core.tests.performance/META-INF/MANIFEST.MF
@@ -6,11 +6,11 @@ Bundle-Version: 3.12.100.qualifier
 Bundle-Vendor: %providerName
 Bundle-Localization: plugin
 Export-Package: org.eclipse.jdt.core.tests.performance,
  org.eclipse.jdt.core.tests.performance.util
 Require-Bundle: org.eclipse.core.resources;bundle-version="[3.2.0,4.0.0)",
- org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
+ org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
  org.eclipse.jdt.core;bundle-version="[3.34.0,4.0.0)",
  org.eclipse.jdt.core.tests.builder;bundle-version="[3.4.0,4.0.0)",
  org.eclipse.jdt.core.tests.compiler;bundle-version="[3.4.0,4.0.0)",
  org.eclipse.jdt.core.tests.model;bundle-version="[3.4.0,4.0.0)",
  org.junit;bundle-version="3.8.1",
diff --git a/org.eclipse.jdt.core/META-INF/MANIFEST.MF b/org.eclipse.jdt.core/META-INF/MANIFEST.MF
index 9d4fda582d..90de68bc67 100644
--- a/org.eclipse.jdt.core/META-INF/MANIFEST.MF
+++ b/org.eclipse.jdt.core/META-INF/MANIFEST.MF
@@ -41,11 +41,11 @@ Export-Package: org.eclipse.jdt.core,
  org.eclipse.jdt.internal.eval;x-internal:=true,
  org.eclipse.jdt.internal.formatter;x-internal:=true,
  org.eclipse.jdt.internal.formatter.linewrap;x-internal:=true,
  org.eclipse.jdt.internal.formatter.old;x-internal:=true
 Require-Bundle: org.eclipse.core.resources;bundle-version="[3.18.0,4.0.0)",
- org.eclipse.core.runtime;bundle-version="[3.13.0,4.0.0)",
+ org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
  org.eclipse.core.filesystem;bundle-version="[1.7.0,2.0.0)",
  org.eclipse.text;bundle-version="[3.6.0,4.0.0)",
  org.eclipse.team.core;bundle-version="[3.1.0,4.0.0)";resolution:=optional,
  org.eclipse.jdt.core.compiler.batch;bundle-version="3.35.0";visibility:=reexport
 Bundle-RequiredExecutionEnvironment: JavaSE-17
diff --git a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaModelManager.java b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaModelManager.java
index 7289f4ce39..27a3b3c923 100644
--- a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaModelManager.java
+++ b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaModelManager.java
@@ -58,11 +58,10 @@ import java.util.concurrent.ForkJoinPool;
 import java.util.concurrent.ForkJoinWorkerThread;
 import java.util.zip.ZipException;
 import java.util.zip.ZipFile;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.eclipse.core.resources.IFile;
 import org.eclipse.core.resources.IFolder;
 import org.eclipse.core.resources.IProject;
@@ -3564,11 +3563,12 @@ public class JavaModelManager implements ISaveParticipant, IContentTypeChangeLis
 		try {
 			if (xmlString != null){
 				StringReader reader = new StringReader(xmlString);
 				Element cpElement;
 				try {
-					DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+					@SuppressWarnings("restriction")
+					DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 					cpElement = parser.parse(new InputSource(reader)).getDocumentElement();
 				} catch(SAXException | ParserConfigurationException e){
 					return;
 				} finally {
 					reader.close();
diff --git a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaProject.java b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaProject.java
index e1ea10e495..8db6515ffe 100644
--- a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaProject.java
+++ b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaProject.java
@@ -37,11 +37,10 @@ import java.util.Set;
 import java.util.function.Function;
 import java.util.jar.Manifest;
 import java.util.stream.Collectors;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import org.eclipse.core.resources.ICommand;
 import org.eclipse.core.resources.IFile;
 import org.eclipse.core.resources.IFolder;
 import org.eclipse.core.resources.IMarker;
@@ -1315,11 +1314,12 @@ public class JavaProject
 		ArrayList paths = new ArrayList();
 		IClasspathEntry defaultOutput = null;
 		StringReader reader = new StringReader(xmlClasspath);
 		Element cpElement;
 		try {
-			DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			@SuppressWarnings("restriction")
+			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			cpElement = parser.parse(new InputSource(reader)).getDocumentElement();
 		} catch (SAXException | ParserConfigurationException e) {
 			throw new IOException(Messages.file_badFormat, e);
 		} finally {
 			reader.close();
@@ -1376,12 +1376,13 @@ public class JavaProject
 			if (encodedEntry == null) return null;
 			StringReader reader = new StringReader(encodedEntry);
 			Element node;
 
 			try {
+				@SuppressWarnings("restriction")
 				DocumentBuilder parser =
-					DocumentBuilderFactory.newInstance().newDocumentBuilder();
+						org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 				node = parser.parse(new InputSource(reader)).getDocumentElement();
 			} catch (SAXException | ParserConfigurationException e) {
 				return null;
 			} finally {
 				reader.close();
diff --git a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/UserLibrary.java b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/UserLibrary.java
index 5eeeb03b5c..b645401640 100644
--- a/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/UserLibrary.java
+++ b/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/UserLibrary.java
@@ -18,11 +18,10 @@ import java.io.IOException;
 import java.io.Reader;
 import java.io.StringWriter;
 import java.util.ArrayList;
 import java.util.HashMap;
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.eclipse.core.runtime.Assert;
 import org.eclipse.core.runtime.IPath;
 import org.eclipse.core.runtime.Path;
@@ -146,11 +145,12 @@ public class UserLibrary {
 	}
 
 	public static UserLibrary createFromString(Reader reader) throws IOException {
 		Element cpElement;
 		try {
-			DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			@SuppressWarnings("restriction")
+			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			cpElement = parser.parse(new InputSource(reader)).getDocumentElement();
 		} catch (SAXException | ParserConfigurationException e) {
 			throw new IOException(Messages.file_badFormat, e);
 		} finally {
 			reader.close();
diff --git a/org.eclipse.jdt.tests.latestBREE/META-INF/MANIFEST.MF b/org.eclipse.jdt.tests.latestBREE/META-INF/MANIFEST.MF
index 992448524d..ea8738df88 100644
--- a/org.eclipse.jdt.tests.latestBREE/META-INF/MANIFEST.MF
+++ b/org.eclipse.jdt.tests.latestBREE/META-INF/MANIFEST.MF
@@ -5,11 +5,11 @@ Bundle-SymbolicName: org.eclipse.jdt.tests.latestBREE
 Bundle-Version: 1.0.0.qualifier
 Bundle-Activator: org.eclipse.jdt.tests.latestbree.Activator
 Require-Bundle: org.junit;bundle-version="3.8.1",
  org.eclipse.jdt.debug;bundle-version="[3.2.0,4.0.0)",
  org.eclipse.jdt.core;bundle-version="[3.10.0,4.0.0)",
- org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
+ org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
  org.eclipse.test.performance;bundle-version="[3.10.0,4.0.0)",
  org.eclipse.core.resources;bundle-version="[3.2.0,4.0.0)",
  org.eclipse.jdt.annotation;bundle-version="[1.1.0,2.0.0)";resolution:=optional,
  org.eclipse.jdt.annotation;bundle-version="[2.0.0,3.0.0)";resolution:=optional,
  org.eclipse.jdt.core.tests.model;bundle-version="[3.10.0,4.0.0)",

Vulnerable code:  org.eclipse.core.runtime;bundle-version="[3.5.100,4.0.0)",
			DocumentBuilder parser =
				DocumentBuilderFactory.newInstance().newDocumentBuilder();
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
		Document actualModel = factory.newDocumentBuilder().newDocument();
        Document expectedModel = factory.newDocumentBuilder().parse(source);
		TransformerFactory tf = TransformerFactory.newInstance();
		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
		Document model = factory.newDocumentBuilder().newDocument();
import javax.xml.parsers.DocumentBuilderFactory;
    	DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        Document expectedModel = factory.newDocumentBuilder().parse(source);
Require-Bundle: org.eclipse.jdt.core.compiler.batch;bundle-version="3.35.0"
			saxParser = SAXParserFactory.newInstance().newSAXParser();
		} catch (ParserConfigurationException e) {
			e.printStackTrace();
			return null;
		} catch (SAXException e) {
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
import javax.xml.parsers.SAXParserFactory;
			SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
			SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.13.0,4.0.0)",
import javax.xml.parsers.DocumentBuilderFactory;
					DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
import javax.xml.parsers.DocumentBuilderFactory;
			DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
					DocumentBuilderFactory.newInstance().newDocumentBuilder();
import javax.xml.parsers.DocumentBuilderFactory;
			DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
Fixed code:  org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
import org.eclipse.core.internal.runtime.XmlProcessorFactory;
			@SuppressWarnings("restriction")
			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory
					.createDocumentBuilderWithErrorOnDOCTYPE();
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
		Document actualModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
        Document expectedModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().parse(source);
		TransformerFactory tf = org.eclipse.core.internal.runtime.XmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
		Document model = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
        Document expectedModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().parse(source);
Require-Bundle: org.eclipse.jdt.core.compiler.batch;bundle-version="3.35.0",
 org.eclipse.core.runtime;bundle-version="3.29.0"
			@SuppressWarnings("restriction")
			SAXParser p = org.eclipse.core.internal.runtime.XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
			saxParser =p;
		} catch (SAXException | ParserConfigurationException e) {
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
import org.eclipse.core.internal.runtime.XmlProcessorFactory;
			SAXParser saxParser = XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
			SAXParser saxParser = XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
					@SuppressWarnings("restriction")
					DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
			@SuppressWarnings("restriction")
			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
				@SuppressWarnings("restriction")
						org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
			@SuppressWarnings("restriction")
			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",