azalea/kotlin-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Configure SAXParserFactory to avoid XXE references

Browse Source 
#KT-51519 Fixed
This commit is contained in:
Alexander Udalov
2022-03-08 15:02:45 +01:00
parent d01e6b61a3
commit 9c78d57de2
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
compiler/cli/cli-common/src/org/jetbrains/kotlin/cli/common/modules/ModuleXmlParser.java
+6 -1
View File
@@ -85,7 +85,12 @@ public class ModuleXmlParser {
private ModuleChunk parse(@NotNull InputStream xml) {
try {
setCurrentState(initial);
SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
SAXParser saxParser = factory.newSAXParser();
saxParser.parse(xml, new DelegatedSaxHandler() {
@NotNull
@Override
compiler/compiler-runner-unshaded/src/org/jetbrains/kotlin/compilerRunner/CompilerOutputParser.kt
+4 -1
View File
@@ -30,7 +30,6 @@ import org.xml.sax.SAXException
import org.xml.sax.helpers.DefaultHandler
import java.io.IOException
import java.io.Reader
import java.util.*
import javax.xml.parsers.SAXParserFactory
object CompilerOutputParser {
@@ -59,6 +58,10 @@ object CompilerOutputParser {
}
try {
val factory = SAXParserFactory.newInstance()
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
factory.setFeature("http://xml.org/sax/features/external-general-entities", false)
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false)
val parser = factory.newSAXParser()
parser.parse(InputSource(wrappingReader), CompilerOutputSAXHandler(messageCollector, collector))
}