aroh3006 opened a new pull request, #413: URL: https://github.com/apache/grails-intellij-plugin/pull/413
Fixes #412. `MvcPluginUtil.parsePluginList` and `parsePluginXml` both parsed XML with a default `SAXBuilder`, which resolves DOCTYPE declarations and external entities. A crafted `plugin.xml` shipped in a project's plugin directory could use an external entity to read local files or reach an attacker-controlled host, and this runs as soon as the Grails plugins dialog is opened or plugin-name completion looks at the plugin descriptors. Both call sites now build their `Document` through a shared `createSecureSaxBuilder()` helper that disallows DOCTYPE declarations outright (`disallow-doctype-decl`), which also blocks external entities since they can only be declared inside a DOCTYPE. A normal, well-formed `plugin.xml` without a DOCTYPE is unaffected. **Verification.** I don't have the IntelliJ Platform SDK set up locally (the Gradle build pulls a multi-GB platform distribution), so I could not run this module's own test suite. Instead I reproduced the issue directly against the same JDOM APIs used here, outside the plugin: an unhardened `SAXBuilder` reading a `plugin.xml` with `<!ENTITY xxe SYSTEM "file://...">` embeds the referenced file's contents into the parsed document; the same document against a builder configured the way this PR configures it throws `JDOMParseException: DOCTYPE is disallowed...` instead, and a normal `plugin.xml` with no DOCTYPE still parses correctly through the hardened builder. Happy to run the actual test suite if someone can point me at a faster way to get the platform SDK, or if a maintainer wants to run it before merging. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
