Changeset 16560 in josm

Timestamp:

2020-06-07T17:19:38+02:00 (5 years ago)

Author:

simon04

Message:

fix #19286 - External entities are resolved when parsing tagging presets (patch by hiddewie, modified)

Location:

trunk

Files:

• src/org/openstreetmap/josm/tools/XmlUtils.java (modified) (2 diffs)
• test/data/dom_external_entity.xml (added)
• test/data/preset_external_entity.xml (added)
• test/unit/org/openstreetmap/josm/gui/tagging/presets/TaggingPresetReaderTest.java (modified) (2 diffs)
• test/unit/org/openstreetmap/josm/tools/XmlUtilsTest.java (added)

trunk/src/org/openstreetmap/josm/tools/XmlUtils.java

@@ -35 +35 @@
  */
 public final class XmlUtils {
+
+    private static final String FEATURE_DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";
 
     private XmlUtils() {
@@ -101 +103 @@
         SAXParserFactory parserFactory = SAXParserFactory.newInstance();
         parserFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        parserFactory.setFeature(FEATURE_DISALLOW_DOCTYPE_DECL, true);
         parserFactory.setNamespaceAware(true);
         return parserFactory.newSAXParser();

trunk/test/unit/org/openstreetmap/josm/gui/tagging/presets/TaggingPresetReaderTest.java

@@ -6 +6 @@
 import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
 
 import java.io.IOException;
@@ -67 +68 @@
 
     /**
+     * Test external entity resolving.
+     * See #19286
+     */
+    @Test
+    public void testExternalEntityResolving() throws IOException {
+        try {
+            TaggingPresetReader.readAll(TestUtils.getTestDataRoot() + "preset_external_entity.xml", true);
+            fail("Reading a file with external entities should throw an SAXParseException!");
+        } catch (SAXException e) {
+            String expected = "DOCTYPE is disallowed when the feature \"http://apache.org/xml/features/disallow-doctype-decl\" set to true.";
+            assertEquals(expected, e.getMessage());
+        }
+    }
+
+    /**
      * Validate internal presets
      * See #9027