feat: add xml parser guidance hook

[simonresch]

A simple guidance hook to nudge Jazzer towards inserting an document xml tag with an external system identifier. If an xml parser is called with fuzzer input and configured to load external entities this will trigger a finding from the SSRF bug detector.

[Copilot]

Pull Request Overview

This PR introduces a guidance hook for XML parsers to help detect SSRF vulnerabilities by steering fuzzer inputs towards patterns that trigger external entity resolution. The hook guides inputs to contain DOCTYPE declarations with external system identifiers, allowing existing SSRF detection mechanisms to catch unauthorized network connections.

Key Changes

• Added XmlParserSsrfGuidance hook that intercepts XML parser entry points and guides inputs toward patterns with external DOCTYPE declarations
• Refactored Utils.kt to extract reusable stream peeking utilities (peekMarkableInputStream, peekMarkableReader)
• Added SsrfXmlParser test case to verify the guidance hook triggers SSRF findings

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/XmlParserSsrfGuidance.kt	Core guidance hook implementation that intercepts XML parser methods and guides inputs toward external entity patterns
sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/Utils.kt	Refactored to provide reusable peekMarkableInputStream and peekMarkableReader utilities
sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/Deserialization.kt	Updated to use refactored peekMarkableInputStream utility
sanitizers/src/test/java/com/example/SsrfXmlParser.java	Test case with vulnerable XML parser configuration
sanitizers/src/test/java/com/example/BUILD.bazel	Build configuration for the new test
sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/BUILD.bazel	Added XmlParserSsrfGuidance to build targets
sanitizers/sanitizers.bzl	Registered XmlParserSsrfGuidance in sanitizer class list

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.