From 9c78d57de27ec9c561f8aa943033463129113a56 Mon Sep 17 00:00:00 2001 From: Alexander Udalov Date: Tue, 8 Mar 2022 15:02:45 +0100 Subject: [PATCH] Configure SAXParserFactory to avoid XXE references #KT-51519 Fixed --- .../kotlin/cli/common/modules/ModuleXmlParser.java | 7 ++++++- .../kotlin/compilerRunner/CompilerOutputParser.kt | 5 ++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/compiler/cli/cli-common/src/org/jetbrains/kotlin/cli/common/modules/ModuleXmlParser.java b/compiler/cli/cli-common/src/org/jetbrains/kotlin/cli/common/modules/ModuleXmlParser.java index 9e61b388871..6b3fe7880b6 100644 --- a/compiler/cli/cli-common/src/org/jetbrains/kotlin/cli/common/modules/ModuleXmlParser.java +++ b/compiler/cli/cli-common/src/org/jetbrains/kotlin/cli/common/modules/ModuleXmlParser.java @@ -85,7 +85,12 @@ public class ModuleXmlParser { private ModuleChunk parse(@NotNull InputStream xml) { try { setCurrentState(initial); - SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser(); + SAXParserFactory factory = SAXParserFactory.newInstance(); + factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + SAXParser saxParser = factory.newSAXParser(); saxParser.parse(xml, new DelegatedSaxHandler() { @NotNull @Override diff --git a/compiler/compiler-runner-unshaded/src/org/jetbrains/kotlin/compilerRunner/CompilerOutputParser.kt b/compiler/compiler-runner-unshaded/src/org/jetbrains/kotlin/compilerRunner/CompilerOutputParser.kt index b130be5cdd7..ec90b1aa834 100644 --- a/compiler/compiler-runner-unshaded/src/org/jetbrains/kotlin/compilerRunner/CompilerOutputParser.kt +++ b/compiler/compiler-runner-unshaded/src/org/jetbrains/kotlin/compilerRunner/CompilerOutputParser.kt @@ -30,7 +30,6 @@ import org.xml.sax.SAXException import org.xml.sax.helpers.DefaultHandler import java.io.IOException import java.io.Reader -import java.util.* import javax.xml.parsers.SAXParserFactory object CompilerOutputParser { @@ -59,6 +58,10 @@ object CompilerOutputParser { } try { val factory = SAXParserFactory.newInstance() + factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) + factory.setFeature("http://xml.org/sax/features/external-general-entities", false) + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false) + factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false) val parser = factory.newSAXParser() parser.parse(InputSource(wrappingReader), CompilerOutputSAXHandler(messageCollector, collector)) }