diff --git a/Ghidra/Framework/Generic/src/main/java/ghidra/xml/ThreadedXmlPullParserImpl.java b/Ghidra/Framework/Generic/src/main/java/ghidra/xml/ThreadedXmlPullParserImpl.java index b7abb2740e..6626789e2d 100644 --- a/Ghidra/Framework/Generic/src/main/java/ghidra/xml/ThreadedXmlPullParserImpl.java +++ b/Ghidra/Framework/Generic/src/main/java/ghidra/xml/ThreadedXmlPullParserImpl.java @@ -62,6 +62,8 @@ class ThreadedXmlPullParserImpl extends AbstractXmlPullParser { * @param file the input XML file * @param errHandler the XML error handler * @param validate true if the parse should validate against the DTD + * @param capacity the number of items that can be added to the queue before the parsing thread + * will block * @throws SAXException if an XML parse error occurs * @throws IOException if an i/o error occurs */ @@ -76,6 +78,8 @@ class ThreadedXmlPullParserImpl extends AbstractXmlPullParser { * @param file the input XML file * @param errHandler the XML error handler * @param validate true if the parse should validate against the DTD + * @param capacity the number of items that can be added to the queue before the parsing thread + * will block * @throws SAXException if an XML parse error occurs * @throws IOException if an i/o error occurs */ @@ -96,14 +100,15 @@ class ThreadedXmlPullParserImpl extends AbstractXmlPullParser { * Note: Only use this method if you know that the XML in the given stream * contains its own internal validation (an internal dtd specification). For * XML files that use an external dtd file you should call - * {@link #XmlParser(File, ErrorHandler, boolean)}. + * {@link #ThreadedXmlPullParserImpl(File, ErrorHandler, boolean, int)}. * * @param input the XML input stream * @param inputName the name of the input stream * @param errHandler the XML error handler * @param validate true if the parse should validate against the DTD + * @param capacity the number of items that can be added to the queue before the parsing thread + * will block * @throws SAXException if an XML parse error occurs - * @throws IOException if an i/o error occurs */ ThreadedXmlPullParserImpl(InputStream input, String inputName, ErrorHandler errHandler, boolean validate, int capacity) throws SAXException { @@ -206,7 +211,6 @@ class ThreadedXmlPullParserImpl extends AbstractXmlPullParser { public void dispose() { disposed = true; parsingTask.cancel(true); -// Msg.debug(this, id + "Disposed"); } private class ContentHandlerRunnable implements Runnable { @@ -223,15 +227,18 @@ class ThreadedXmlPullParserImpl extends AbstractXmlPullParser { try { SAXParserFactory saxParserFactory = XmlUtilities.createSecureSAXParserFactory(true); + saxParserFactory.setFeature( + "http://apache.org/xml/features/nonvalidating/load-external-dtd", false); saxParserFactory.setFeature("http://xml.org/sax/features/namespaces", false); saxParserFactory.setFeature("http://xml.org/sax/features/validation", validate); saxParser = saxParserFactory.newSAXParser(); saxParser.getXMLReader().setEntityResolver((publicId, systemId) -> { if (resolveDir == null) { - return null; + return new InputSource(new StringReader("")); // empty DTD } - ResourceFile resolvedFile = - new ResourceFile(resolveDir, new File(systemId).getName()); + + String filename = new File(systemId).getName(); + ResourceFile resolvedFile = new ResourceFile(resolveDir, filename); InputSource inputSource = new InputSource(); inputSource.setPublicId(publicId); inputSource.setSystemId(resolvedFile.toURI().toString()); diff --git a/Ghidra/Framework/Generic/src/main/java/ghidra/xml/XmlPullParserFactory.java b/Ghidra/Framework/Generic/src/main/java/ghidra/xml/XmlPullParserFactory.java index 4c0421f880..5298f4651f 100644 --- a/Ghidra/Framework/Generic/src/main/java/ghidra/xml/XmlPullParserFactory.java +++ b/Ghidra/Framework/Generic/src/main/java/ghidra/xml/XmlPullParserFactory.java @@ -4,9 +4,9 @@ * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * + * * http://www.apache.org/licenses/LICENSE-2.0 - * + * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -15,13 +15,13 @@ */ package ghidra.xml; -import generic.jar.ResourceFile; - import java.io.*; import org.xml.sax.ErrorHandler; import org.xml.sax.SAXException; +import generic.jar.ResourceFile; + public class XmlPullParserFactory { public static void setCreateTracingParsers(XmlTracer xmlTracer) { throw new UnsupportedOperationException( @@ -39,9 +39,11 @@ public class XmlPullParserFactory { * the XML error handler * @param validate * true if the parse should validate against the DTD + * @return the parser * @throws SAXException * if an XML parse error occurs * @throws IOException + * if an i/o error occurs */ public static XmlPullParser create(InputStream input, String inputName, ErrorHandler errHandler, boolean validate) throws SAXException, IOException { @@ -57,6 +59,7 @@ public class XmlPullParserFactory { * the XML error handler * @param validate * true if the parse should validate against the DTD + * @return the parser * @throws SAXException * if an XML parse error occurs * @throws IOException @@ -76,6 +79,7 @@ public class XmlPullParserFactory { * the XML error handler * @param validate * true if the parse should validate against the DTD + * @return the parser * @throws SAXException * if an XML parse error occurs * @throws IOException @@ -97,6 +101,7 @@ public class XmlPullParserFactory { * the XML error handler * @param validate * true if the parse should validate against the DTD + * @return the parser * @throws SAXException * if an XML parse error occurs */ diff --git a/Ghidra/Framework/Generic/src/test/java/ghidra/xml/ThreadedXmlParserTest.java b/Ghidra/Framework/Generic/src/test/java/ghidra/xml/ThreadedXmlParserTest.java index 2073d856bb..b1259b7c1b 100644 --- a/Ghidra/Framework/Generic/src/test/java/ghidra/xml/ThreadedXmlParserTest.java +++ b/Ghidra/Framework/Generic/src/test/java/ghidra/xml/ThreadedXmlParserTest.java @@ -4,9 +4,9 @@ * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * + * * http://www.apache.org/licenses/LICENSE-2.0 - * + * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -44,17 +44,11 @@ public class ThreadedXmlParserTest extends AbstractGenericTest { "" + "" + "" + "" + ""; - private static final String XXE_XML = "\n" + "\n" + "]>&xxe; fizzbizz"; - - public ThreadedXmlParserTest() { - super(); - } /** - *

* XML External Entities attacks benefit from an XML feature to build documents dynamically at * the time of processing. An XML entity allows inclusion of data dynamically from a given * resource. External entities allow an XML document to include data from an external URI. @@ -71,7 +65,7 @@ public class ThreadedXmlParserTest extends AbstractGenericTest { * than ResourceFile) will use a default Entity Resolver. The XmlUtilities.createSecureSAXParserFactory * factory configurations will disable external entities regardless of which Entity Resolver is used. * - * @throws Exception + * @throws Exception if there is an exception */ @Test public void testXXEXml() throws Exception {