XML External Entity (XXE)

Calcite Core is vulnerable to XML external entity attacks. A remote attacker is able to read the contents of confidential files through the use of SQL functions such as EXISTSNODE, EXTRACTXML, XMLTRANSFORM or EXTRACTVALUE due to insecure business logic in XmlFunctions.java...