CVE-2018-20222 Prevent xxe during parse

Signed-off-by: Andrew DeMaria <lostonamountain@gmail.com>
master
Andrew DeMaria 6 years ago
parent faedfd8a62
commit 1a88f46c18
No known key found for this signature in database
GPG Key ID: 0A3F5E91F8364EDF
  1. 4
      airsonic-main/src/main/java/org/airsonic/player/ajax/LyricsService.java
  2. 4
      airsonic-main/src/main/java/org/airsonic/player/controller/JAXBWriter.java
  3. 5
      airsonic-main/src/main/java/org/airsonic/player/service/PodcastService.java
  4. 14
      airsonic-main/src/main/java/org/airsonic/player/util/XMLUtil.java

@ -39,6 +39,8 @@ import java.io.IOException;
import java.io.StringReader; import java.io.StringReader;
import java.net.SocketException; import java.net.SocketException;
import static org.airsonic.player.util.XMLUtil.createSAXBuilder;
/** /**
* Provides AJAX-enabled services for retrieving song lyrics from chartlyrics.com. * Provides AJAX-enabled services for retrieving song lyrics from chartlyrics.com.
* <p/> * <p/>
@ -80,7 +82,7 @@ public class LyricsService {
} }
private LyricsInfo parseSearchResult(String xml) throws Exception { private LyricsInfo parseSearchResult(String xml) throws Exception {
SAXBuilder builder = new SAXBuilder(); SAXBuilder builder = createSAXBuilder();
Document document = builder.build(new StringReader(xml)); Document document = builder.build(new StringReader(xml));
Element root = document.getRootElement(); Element root = document.getRootElement();

@ -25,7 +25,6 @@ import org.eclipse.persistence.jaxb.JAXBContext;
import org.eclipse.persistence.jaxb.MarshallerProperties; import org.eclipse.persistence.jaxb.MarshallerProperties;
import org.jdom.Attribute; import org.jdom.Attribute;
import org.jdom.Document; import org.jdom.Document;
import org.jdom.input.SAXBuilder;
import org.slf4j.Logger; import org.slf4j.Logger;
import org.slf4j.LoggerFactory; import org.slf4j.LoggerFactory;
import org.subsonic.restapi.Error; import org.subsonic.restapi.Error;
@ -46,6 +45,7 @@ import java.io.StringWriter;
import java.util.Date; import java.util.Date;
import java.util.GregorianCalendar; import java.util.GregorianCalendar;
import static org.airsonic.player.util.XMLUtil.createSAXBuilder;
import static org.springframework.web.bind.ServletRequestUtils.getStringParameter; import static org.springframework.web.bind.ServletRequestUtils.getStringParameter;
/** /**
@ -100,7 +100,7 @@ public class JAXBWriter {
InputStream in = null; InputStream in = null;
try { try {
in = StringUtil.class.getResourceAsStream("/subsonic-rest-api.xsd"); in = StringUtil.class.getResourceAsStream("/subsonic-rest-api.xsd");
Document document = new SAXBuilder().build(in); Document document = createSAXBuilder().build(in);
Attribute version = document.getRootElement().getAttribute("version"); Attribute version = document.getRootElement().getAttribute("version");
return version.getValue(); return version.getValue();
} finally { } finally {

@ -45,7 +45,6 @@ import org.apache.http.impl.client.HttpClients;
import org.jdom.Document; import org.jdom.Document;
import org.jdom.Element; import org.jdom.Element;
import org.jdom.Namespace; import org.jdom.Namespace;
import org.jdom.input.SAXBuilder;
import org.slf4j.Logger; import org.slf4j.Logger;
import org.slf4j.LoggerFactory; import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
@ -62,6 +61,8 @@ import java.text.SimpleDateFormat;
import java.util.*; import java.util.*;
import java.util.concurrent.*; import java.util.concurrent.*;
import static org.airsonic.player.util.XMLUtil.createSAXBuilder;
/** /**
* Provides services for Podcast reception. * Provides services for Podcast reception.
* *
@ -317,7 +318,7 @@ public class PodcastService {
try (CloseableHttpResponse response = client.execute(method)) { try (CloseableHttpResponse response = client.execute(method)) {
in = response.getEntity().getContent(); in = response.getEntity().getContent();
Document document = new SAXBuilder().build(in); Document document = createSAXBuilder().build(in);
Element channelElement = document.getRootElement().getChild("channel"); Element channelElement = document.getRootElement().getChild("channel");
channel.setTitle(StringUtil.removeMarkup(channelElement.getChildTextTrim("title"))); channel.setTitle(StringUtil.removeMarkup(channelElement.getChildTextTrim("title")));

@ -0,0 +1,14 @@
package org.airsonic.player.util;
import org.jdom.input.SAXBuilder;
public class XMLUtil {
public static SAXBuilder createSAXBuilder() {
SAXBuilder builder = new SAXBuilder();
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl",true);
builder.setFeature("http://xml.org/sax/features/external-general-entities", false);
builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
return builder;
}
}
Loading…
Cancel
Save