Backport upstream commit 77081dc5e to assertj-core 3.19.0 to
fix CVE-2026-24400. The patch hardens XmlStringPrettyFormatter
against XML External Entity (XXE) attacks by enabling
FEATURE_SECURE_PROCESSING and disallowing DOCTYPE declarations
in the XML parser configuration. Two new tests verify that
inputs containing DOCTYPE declarations with entity and
parameter entity injections are properly rejected.
CVE: CVE-2026-24400
Upstream patches:
- 77081dc5eb.patch
Resolves: RHEL-208834
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
