XML External Entity attack in mapfish-print

An attacker can craft a malicious SDL style document containing XML External Entity (XXE) references that point to local files or internal network resources [CWE-611]. When the MapFish Print server processes this SDL style, the XML parser resolves the external entities, potentially disclosing sensitive file contents or performing server-side request forgery. The attack requires the ability to supply a crafted SDL style to the print service, which can be done through the print request specification. No authentication is mentioned as a prerequisite in the advisory.

The vulnerability resides in the `MapPrinterServlet` class and its handling of SDL style XML documents. The patch removes JSONP callback parameters from multiple endpoints (`getStatus`, `getCapabilities`, `listAppIds`, `getExampleRequest`) and disables XML external entity processing in the XML parser used for SDL styles. The test file `MapPrinterServletTest.java` is also updated to reflect the removed JSONP functionality.

The patch removes JSONP callback functionality from all servlet endpoints (`getStatus`, `getCapabilities`, `listAppIds`, `getExampleRequest`), which eliminates a potential vector for JSONP-based attacks. More importantly, the patch disables XML external entity processing in the XML parser used to parse SDL style documents, preventing XXE attacks. The diff shows the removal of the `jsonpCallback` parameter from method signatures and the corresponding test cases for JSONP responses. The advisory does not show the exact XML parser configuration change, but the commit message indicates it fixes security issues including the XXE vulnerability.