Fix XXE vulnerabilities

redhat-developer · Nov 30, 2020 · e66855e · e66855e
1 parent 0b0a17c
commit e66855e
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 4 deletions.
diff --git a/...src/main/java/org/jboss/tools/rsp/internal/launching/java/util/LaunchingSupportUtils.java b/...src/main/java/org/jboss/tools/rsp/internal/launching/java/util/LaunchingSupportUtils.java
@@ -7,6 +7,7 @@
  * Contributors: Red Hat, Inc.
  ******************************************************************************/
 package org.jboss.tools.rsp.internal.launching.java.util;
+import javax.xml.XMLConstants;
 
 import java.io.ByteArrayInputStream;
 import java.io.File;
@@ -82,7 +83,7 @@ public class LaunchingSupportUtils {
 	private static DocumentBuilder getParser() throws CoreException {
 		if (fgXMLParser == null) {
 			try {
-				fgXMLParser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+				fgXMLParser = createDocumentBuilderFactory().newDocumentBuilder();
 				fgXMLParser.setErrorHandler(new DefaultHandler());
 			} catch (ParserConfigurationException e) {
 				abort(LaunchingPlugin_34, e);
@@ -348,4 +349,11 @@ protected static void abort(String message, Throwable exception, int code) throw
 		throw new CoreException(new Status(IStatus.ERROR, IVMInstallChangedListener.LAUNCHING_ID_PLUGIN,
 				code, message, exception));
 	}
+
+	private static DocumentBuilderFactory createDocumentBuilderFactory() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+		return factory;
+	}
 }
diff --git a/...s.tools.rsp.launching/src/main/java/org/jboss/tools/rsp/launching/memento/XMLMemento.java b/...s.tools.rsp.launching/src/main/java/org/jboss/tools/rsp/launching/memento/XMLMemento.java
@@ -89,7 +89,7 @@ public static XMLMemento createReadRoot(InputStream in) {
 
 		Document document = null;
 		try {	
-			DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+			DocumentBuilderFactory factory = createDocumentBuilderFactory();
 			DocumentBuilder parser = factory.newDocumentBuilder();
 			document = parser.parse(new InputSource(in));
 			Node node = document.getFirstChild();
@@ -126,7 +126,7 @@ private static void logError(Exception t) {
 	public static XMLMemento createWriteRoot(String type) {
 		Document document;
 		try {
-			document = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument();
+			document = createDocumentBuilderFactory().newDocumentBuilder().newDocument();
 			Element element = document.createElement(type);
 			document.appendChild(element);
 			return new XMLMemento(document, element);
@@ -348,7 +348,7 @@ public void save(OutputStream os) throws IOException {
 		Result result = new StreamResult(os);
 		Source source = new DOMSource(factory);
 		try {
-			TransformerFactory factory = TransformerFactory.newInstance();
+			TransformerFactory factory = createTransformerFactory();
 			factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
 			Transformer transformer = factory.newTransformer();
 			transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
@@ -436,4 +436,18 @@ public String getTextData() {
 		}
 		return ""; //$NON-NLS-1$
 	}
+
+	private static DocumentBuilderFactory createDocumentBuilderFactory() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+		return factory;
+	}
+
+	private static TransformerFactory createTransformerFactory() {
+		TransformerFactory factory = TransformerFactory.newInstance();
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+		return factory;
+	}
 }