diff options
author | Sarika Sinha | 2021-12-13 18:22:27 +0000 |
---|---|---|
committer | Sarika Sinha | 2022-01-05 07:21:34 +0000 |
commit | 8b551e012dac5497baf51f5eea6cd597ed9aeff7 (patch) | |
tree | 4446e304d7be53731c6778bb188413562a73faa2 | |
parent | b7dd9ba855a87263cbb199e6bdbbda0cb7bdc389 (diff) | |
download | eclipse.platform.ui-R4_13_maintenance.tar.gz eclipse.platform.ui-R4_13_maintenance.tar.xz eclipse.platform.ui-R4_13_maintenance.zip |
Bug 577894 - Security Issue -- XXE AttackR4_13_maintenance
Applications using XMLMemento are vulnerable to XXE Attack
see https://docs.oracle.com/en/java/javase/17/security/java-api-xml-processing-jaxp-security-guide.html
Change-Id: I31013372fe98566731410406dcad3044dc6992d9
Reviewed-on: https://git.eclipse.org/r/c/platform/eclipse.platform.ui/+/188792
Reviewed-by: Kalyan Prasad Tatavarthi <kalyan_prasad@in.ibm.com>
Tested-by: Platform Bot <platform-bot@eclipse.org>
(cherry picked from commit 0e1a84ff99587099d104c0ecd0f35e25fe400d74)
Reviewed-on: https://git.eclipse.org/r/c/platform/eclipse.platform.ui/+/189016
Tested-by: Sarika Sinha <sarika.sinha@in.ibm.com>
Reviewed-by: Sarika Sinha <sarika.sinha@in.ibm.com>
(cherry picked from commit e74a513e0f0269842ebd5f133efee94e83562d84)
Reviewed-on: https://git.eclipse.org/r/c/platform/eclipse.platform.ui/+/189030
(cherry picked from commit 04989448df32a5698a4a5cd6f26bd1f3b3be613c)
Reviewed-on: https://git.eclipse.org/r/c/platform/eclipse.platform.ui/+/189271
(cherry picked from commit 0909d771ba66b9bdde554a0f1ec2271c63c8b741)
Reviewed-on: https://git.eclipse.org/r/c/platform/eclipse.platform.ui/+/189272
(cherry picked from commit 179c6870178c6ac9f84afffea9480519b70018c4)
Reviewed-on: https://git.eclipse.org/r/c/platform/eclipse.platform.ui/+/189274
-rw-r--r-- | bundles/org.eclipse.ui.workbench/Eclipse UI/org/eclipse/ui/XMLMemento.java | 48 |
1 files changed, 45 insertions, 3 deletions
diff --git a/bundles/org.eclipse.ui.workbench/Eclipse UI/org/eclipse/ui/XMLMemento.java b/bundles/org.eclipse.ui.workbench/Eclipse UI/org/eclipse/ui/XMLMemento.java index 349db12d4e8..c926399df95 100644 --- a/bundles/org.eclipse.ui.workbench/Eclipse UI/org/eclipse/ui/XMLMemento.java +++ b/bundles/org.eclipse.ui.workbench/Eclipse UI/org/eclipse/ui/XMLMemento.java @@ -1,5 +1,5 @@ /******************************************************************************* - * Copyright (c) 2000, 2018 IBM Corporation and others. + * Copyright (c) 2000, 2021 IBM Corporation and others. * * This program and the accompanying materials * are made available under the terms of the Eclipse Public License 2.0 @@ -19,6 +19,7 @@ import java.io.Reader; import java.io.StringWriter; import java.io.Writer; import java.util.ArrayList; +import java.util.Arrays; import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; @@ -51,6 +52,8 @@ public final class XMLMemento implements IMemento { private Element element; + private static String FILE_STRING = "file"; //$NON-NLS-1$ + /** * Creates a <code>Document</code> from the <code>Reader</code> and returns a * memento on the first <code>Element</code> for reading the document. @@ -67,6 +70,28 @@ public final class XMLMemento implements IMemento { } /** + * Clients who need to use the "file" protocol can override this method to + * return the original attribute value + * + * @param attributeOldValue + * @return return the new attribute value after concatenating the "file" + * protocol restriction if does not exist already + */ + private static String getAttributeNewValue(Object attributeOldValue) { + StringBuffer strNewValue = new StringBuffer(FILE_STRING); + if (attributeOldValue instanceof String && ((String) attributeOldValue).length() != 0) { + String strOldValue = (String) attributeOldValue; + boolean exists = Arrays.asList(strOldValue.split(",")).stream().anyMatch(x -> x.trim().equals(FILE_STRING)); //$NON-NLS-1$ + if (!exists) { + strNewValue.append(", ").append(strOldValue); //$NON-NLS-1$ + } else { + strNewValue = new StringBuffer(strOldValue); + } + } + return strNewValue.toString(); + } + + /** * Creates a <code>Document</code> from the <code>Reader</code> and returns a * memento on the first <code>Element</code> for reading the document. * @@ -82,9 +107,21 @@ public final class XMLMemento implements IMemento { public static XMLMemento createReadRoot(Reader reader, String baseDir) throws WorkbenchException { String errorMessage = null; Exception exception = null; - + DocumentBuilderFactory factory = null; + Object attributeDTDOldValue = null; + Object attributeSchemaOldValue = null; try { - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + factory = DocumentBuilderFactory.newInstance(); + try { + attributeDTDOldValue = factory.getAttribute(javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD); + attributeSchemaOldValue = factory.getAttribute(javax.xml.XMLConstants.ACCESS_EXTERNAL_SCHEMA); + } catch (NullPointerException | IllegalArgumentException e) { + // Attributes not defined + } + factory.setAttribute(javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD, + getAttributeNewValue(attributeDTDOldValue)); + factory.setAttribute(javax.xml.XMLConstants.ACCESS_EXTERNAL_SCHEMA, + getAttributeNewValue(attributeSchemaOldValue)); DocumentBuilder parser = factory.newDocumentBuilder(); InputSource source = new InputSource(reader); if (baseDir != null) { @@ -131,6 +168,11 @@ public final class XMLMemento implements IMemento { } catch (SAXException e) { exception = e; errorMessage = WorkbenchMessages.XMLMemento_formatError; + } finally { + if (factory != null) { + factory.setAttribute(javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD, attributeDTDOldValue); + factory.setAttribute(javax.xml.XMLConstants.ACCESS_EXTERNAL_SCHEMA, attributeSchemaOldValue); + } } String problemText = null; |