diff options
| author | Brian de Alwis | 2017-08-30 19:47:56 +0000 |
|---|---|---|
| committer | Brian de Alwis | 2017-08-31 14:03:37 +0000 |
| commit | 71ce503c0e1dabec9f7d65841ee4852c59f0432f (patch) | |
| tree | 056464f9a7ecd98f8b44b25cfcbf6fe9c9f208cf /bundles/org.eclipse.equinox.p2.repository | |
| parent | 70c366fd4d0475ed1fd826cbf2283f8ed3b3ebec (diff) | |
| download | rt.equinox.p2-71ce503c0e1dabec9f7d65841ee4852c59f0432f.tar.gz rt.equinox.p2-71ce503c0e1dabec9f7d65841ee4852c59f0432f.tar.xz rt.equinox.p2-71ce503c0e1dabec9f7d65841ee4852c59f0432f.zip | |
Bug 518031 - XML External Entity Vulnerability in Eclipse IDEI20170904-0230I20170903-2000I20170902-1500I20170901-2000
Ensure XML processors are configured to use XMLConstants.FEATURE_SECURE_PROCESSING=true
to avoid accessing external DTDs and expanding external entities.
Change-Id: Ic29e4a0aab1ea5f642ce49914bc6fcecd238efe8
Signed-off-by: Brian de Alwis <bsd@mt.ca>
Diffstat (limited to 'bundles/org.eclipse.equinox.p2.repository')
| -rw-r--r-- | bundles/org.eclipse.equinox.p2.repository/src/org/eclipse/equinox/internal/p2/persistence/XMLParser.java | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/bundles/org.eclipse.equinox.p2.repository/src/org/eclipse/equinox/internal/p2/persistence/XMLParser.java b/bundles/org.eclipse.equinox.p2.repository/src/org/eclipse/equinox/internal/p2/persistence/XMLParser.java index fb0570f27..cf03355c2 100644 --- a/bundles/org.eclipse.equinox.p2.repository/src/org/eclipse/equinox/internal/p2/persistence/XMLParser.java +++ b/bundles/org.eclipse.equinox.p2.repository/src/org/eclipse/equinox/internal/p2/persistence/XMLParser.java @@ -15,8 +15,7 @@ import java.util.*; import javax.xml.parsers.*; import org.eclipse.core.runtime.*; import org.eclipse.equinox.internal.p2.core.Activator; -import org.eclipse.equinox.internal.p2.core.helpers.OrderedProperties; -import org.eclipse.equinox.internal.p2.core.helpers.Tracing; +import org.eclipse.equinox.internal.p2.core.helpers.*; import org.eclipse.equinox.p2.metadata.Version; import org.eclipse.equinox.p2.metadata.VersionRange; import org.eclipse.osgi.util.NLS; @@ -72,7 +71,14 @@ public abstract class XMLParser extends DefaultHandler implements XMLConstants { xmlTracker = new ServiceTracker<SAXParserFactory, SAXParserFactory>(context, SAXParserFactory.class, null); xmlTracker.open(); } - return xmlTracker.getService(); + // FEATURE_SECURE_PROCESSING is documented as must be supported by all implementations + SAXParserFactory factory = xmlTracker.getService(); + try { + factory.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true); + } catch (ParserConfigurationException | SAXNotRecognizedException | SAXNotSupportedException e) { + LogHelper.log(new Status(IStatus.WARNING, Activator.ID, "Feature not supported", e)); //$NON-NLS-1$ + } + return factory; } protected synchronized static void releaseXMLParsing() { |