Issue discovered on `spring-integration-xml/src/main/java/org/springframework/integration/xml/splitter/XPathMessageSplitter.java` with `XML parser XXE vulnerability`

[knutwannheden]

Problem

Error:

 gResult();

Message:

TraitErrors: 
- Method must be created from class org.openrewrite.java.tree.J$MethodDeclaration but was class org.openrewrite.java.tree.J$Block
- InstanceInitializer must be created from class org.openrewrite.java.tree.J$Block but was class org.openrewrite.java.tree.J$Lambda
- Field must be declared in a class, interface, or anonymous class

Detail:

org.openrewrite.analysis.trait.util.TraitErrorsException: TraitErrors: 
- Method must be created from class org.openrewrite.java.tree.J$MethodDeclaration but was class org.openrewrite.java.tree.J$Block
- InstanceInitializer must be created from class org.openrewrite.java.tree.J$Block but was class org.openrewrite.java.tree.J$Lambda
- Field must be declared in a class, interface, or anonymous class
 org.openrewrite.analysis.trait.util.TraitErrors.doThrow(TraitErrors.java:43)
 fj.data.Either$RightProjection.on(Either.java:531)
 fj.data.Validation.on(Validation.java:146)
 org.openrewrite.analysis.trait.expr.VarAccessBase$1.visitVariable(VarAccess.java:187)
 org.openrewrite.analysis.trait.expr.VarAccessBase$1.visitVariable(VarAccess.java:175)
 org.openrewrite.java.tree.J$VariableDeclarations$NamedVariable.acceptJava(J.java:5627)
 org.openrewrite.java.tree.J.accept(J.java:59)
 org.openrewrite.TreeVisitor.visit(TreeVisitor.java:278)
 ...

Expected behavior

Describe what you expected to see.

Example diff

From: spring-integration-xml/src/main/java/org/springframework/integration/xml/splitter/XPathMessageSplitter.java

        else {
return new TransformFunctionIterator((Iterator<Node>) nodes,
node -> {
-                       StringResult result = new StringResult();
+                       StringResult {{80000000-0001-156c-0000-000000000000}}result = new StringResult(){{80000000-0001-156c-0000-000000000000}};
try {
    transformer.transform(new DOMSource(node), result);
}

Recipes in example diff:

• org.openrewrite.java.security.XmlParserXXEVulnerability

References:

• View original result
• Recipe ID: org.openrewrite.java.security.XmlParserXXEVulnerability
• Recipe Name: XML parser XXE vulnerability
• Repository: spring-projects/spring-integration/main
• Created at Wed Nov 08 2023 20:08:24 GMT+0100 (Central European Standard Time)

[knutwannheden]

Looks like this is a duplicate of #31.