erik/mobibot
erik/mobibot
1
1
Fork 0
Code Issues Releases Activity

Prevent XML External Entities vulnerability in CurrenctyConverter module.

Browse source
This commit is contained in:
Erik C. Thauvin 2020-03-18 15:47:51 -07:00
parent acc7c42112
commit 4aa8cc2df6
6 changed files with 16 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.idea/mobibot.iml generated
View file

@ -1,5 +1,5 @@
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<module external.linked.project.id="mobibot" external.linked.project.path="$MODULE_DIR$" external.root.project.path="$MODULE_DIR$" external.system.id="GRADLE" external.system.module.group="" external.system.module.version="0.7.3-beta+571" type="JAVA_MODULE" version="4"> <module external.linked.project.id="mobibot" external.linked.project.path="$MODULE_DIR$" external.root.project.path="$MODULE_DIR$" external.system.id="GRADLE" external.system.module.group="" external.system.module.version="0.7.3-beta+574" type="JAVA_MODULE" version="4">
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_14" inherit-compiler-output="true"> <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_14" inherit-compiler-output="true">
<exclude-output /> <exclude-output />
<content url="file://$MODULE_DIR$"> <content url="file://$MODULE_DIR$">

8
.idea/modules/mobibot.main.iml generated
View file

@ -1,5 +1,5 @@
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<module external.linked.project.id="mobibot:main" external.linked.project.path="$MODULE_DIR$/../.." external.root.project.path="$MODULE_DIR$/../.." external.system.id="GRADLE" external.system.module.group="" external.system.module.type="sourceSet" external.system.module.version="0.7.3-beta+571" type="JAVA_MODULE" version="4"> <module external.linked.project.id="mobibot:main" external.linked.project.path="$MODULE_DIR$/../.." external.root.project.path="$MODULE_DIR$/../.." external.system.id="GRADLE" external.system.module.group="" external.system.module.type="sourceSet" external.system.module.version="0.7.3-beta+574" type="JAVA_MODULE" version="4">
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_14"> <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_14">
<output url="file://$MODULE_DIR$/../../build/classes/java/main" /> <output url="file://$MODULE_DIR$/../../build/classes/java/main" />
<exclude-output /> <exclude-output />
@ -12,8 +12,10 @@
</content> </content>
<orderEntry type="inheritedJdk" /> <orderEntry type="inheritedJdk" />
<orderEntry type="sourceFolder" forTests="false" /> <orderEntry type="sourceFolder" forTests="false" />
<orderEntry type="library" scope="PROVIDED" name="Gradle: net.thauvin.erik:semver:1.2.0" level="project" />
<orderEntry type="library" name="Gradle: pircbot:pircbot:1.5.0" level="project" /> <orderEntry type="library" name="Gradle: pircbot:pircbot:1.5.0" level="project" />
<orderEntry type="library" scope="PROVIDED" name="Gradle: pircbot:pircbot:sources:1.5.0" level="project" /> <orderEntry type="library" scope="PROVIDED" name="Gradle: pircbot:pircbot:sources:1.5.0" level="project" />
<orderEntry type="library" scope="PROVIDED" name="Gradle: com.github.spotbugs:spotbugs-annotations:4.0.0" level="project" />
<orderEntry type="library" name="Gradle: org.apache.logging.log4j:log4j-core:2.13.1" level="project" /> <orderEntry type="library" name="Gradle: org.apache.logging.log4j:log4j-core:2.13.1" level="project" />
<orderEntry type="library" name="Gradle: org.apache.logging.log4j:log4j-slf4j-impl:2.13.1" level="project" /> <orderEntry type="library" name="Gradle: org.apache.logging.log4j:log4j-slf4j-impl:2.13.1" level="project" />
<orderEntry type="library" name="Gradle: org.apache.logging.log4j:log4j-api:2.13.1" level="project" /> <orderEntry type="library" name="Gradle: org.apache.logging.log4j:log4j-api:2.13.1" level="project" />
@ -30,8 +32,7 @@
<orderEntry type="library" name="Gradle: org.twitter4j:twitter4j-core:4.0.7" level="project" /> <orderEntry type="library" name="Gradle: org.twitter4j:twitter4j-core:4.0.7" level="project" />
<orderEntry type="library" name="Gradle: org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.3.70" level="project" /> <orderEntry type="library" name="Gradle: org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.3.70" level="project" />
<orderEntry type="library" name="Gradle: org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.3.70" level="project" /> <orderEntry type="library" name="Gradle: org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.3.70" level="project" />
<orderEntry type="library" scope="PROVIDED" name="Gradle: net.thauvin.erik:semver:1.2.0" level="project" /> <orderEntry type="library" scope="PROVIDED" name="Gradle: com.google.code.findbugs:jsr305:3.0.2" level="project" />
<orderEntry type="library" scope="PROVIDED" name="Gradle: com.github.spotbugs:spotbugs-annotations:4.0.0" level="project" />
<orderEntry type="library" name="Gradle: org.slf4j:slf4j-api:1.7.25" level="project" /> <orderEntry type="library" name="Gradle: org.slf4j:slf4j-api:1.7.25" level="project" />
<orderEntry type="library" name="Gradle: org.jetbrains.kotlin:kotlin-stdlib:1.3.70" level="project" /> <orderEntry type="library" name="Gradle: org.jetbrains.kotlin:kotlin-stdlib:1.3.70" level="project" />
<orderEntry type="library" name="Gradle: com.squareup.retrofit2:converter-gson:2.5.0" level="project" /> <orderEntry type="library" name="Gradle: com.squareup.retrofit2:converter-gson:2.5.0" level="project" />
@ -40,7 +41,6 @@
<orderEntry type="library" name="Gradle: com.squareup.okio:okio:2.4.3" level="project" /> <orderEntry type="library" name="Gradle: com.squareup.okio:okio:2.4.3" level="project" />
<orderEntry type="library" name="Gradle: com.rometools:rome-utils:1.12.2" level="project" /> <orderEntry type="library" name="Gradle: com.rometools:rome-utils:1.12.2" level="project" />
<orderEntry type="library" name="Gradle: org.jdom:jdom2:2.0.6" level="project" /> <orderEntry type="library" name="Gradle: org.jdom:jdom2:2.0.6" level="project" />
<orderEntry type="library" scope="PROVIDED" name="Gradle: com.google.code.findbugs:jsr305:3.0.2" level="project" />
<orderEntry type="library" name="Gradle: org.jetbrains.kotlin:kotlin-stdlib-common:1.3.70" level="project" /> <orderEntry type="library" name="Gradle: org.jetbrains.kotlin:kotlin-stdlib-common:1.3.70" level="project" />
<orderEntry type="library" name="Gradle: org.jetbrains:annotations:13.0" level="project" /> <orderEntry type="library" name="Gradle: org.jetbrains:annotations:13.0" level="project" />
</component> </component>

2
.idea/modules/mobibot.test.iml generated
View file

@ -1,5 +1,5 @@
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<module external.linked.project.id="mobibot:test" external.linked.project.path="$MODULE_DIR$/../.." external.root.project.path="$MODULE_DIR$/../.." external.system.id="GRADLE" external.system.module.group="" external.system.module.type="sourceSet" external.system.module.version="0.7.3-beta+571" type="JAVA_MODULE" version="4"> <module external.linked.project.id="mobibot:test" external.linked.project.path="$MODULE_DIR$/../.." external.root.project.path="$MODULE_DIR$/../.." external.system.id="GRADLE" external.system.module.group="" external.system.module.type="sourceSet" external.system.module.version="0.7.3-beta+574" type="JAVA_MODULE" version="4">
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_14"> <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_14">
<output-test url="file://$MODULE_DIR$/../../build/classes/java/test" /> <output-test url="file://$MODULE_DIR$/../../build/classes/java/test" />
<exclude-output /> <exclude-output />

6
src/generated/java/net/thauvin/erik/mobibot/ReleaseInfo.java
View file

@ -14,13 +14,13 @@ import java.time.*;
public final class ReleaseInfo { public final class ReleaseInfo {
public static final String PROJECT = "mobibot"; public static final String PROJECT = "mobibot";
public static final LocalDateTime BUILDDATE = public static final LocalDateTime BUILDDATE =
LocalDateTime.ofInstant(Instant.ofEpochMilli(1584495033449L), ZoneId.systemDefault()); LocalDateTime.ofInstant(Instant.ofEpochMilli(1584571512171L), ZoneId.systemDefault());
public static final int MAJOR = 0; public static final int MAJOR = 0;
public static final int MINOR = 7; public static final int MINOR = 7;
public static final int PATCH = 3; public static final int PATCH = 3;
public static final String PRERELEASE = "beta"; public static final String PRERELEASE = "beta";
public static final String BUILDMETA = "566"; public static final String BUILDMETA = "579";
public static final String VERSION = "0.7.3-beta+566"; public static final String VERSION = "0.7.3-beta+579";
/** /**
* Disables the default constructor. * Disables the default constructor.

4
src/main/java/net/thauvin/erik/mobibot/modules/CurrencyConverter.java
View file

@ -47,6 +47,7 @@ import org.jdom2.JDOMException;
import org.jdom2.Namespace; import org.jdom2.Namespace;
import org.jdom2.input.SAXBuilder; import org.jdom2.input.SAXBuilder;
import javax.xml.XMLConstants;
import java.io.IOException; import java.io.IOException;
import java.net.URL; import java.net.URL;
import java.text.NumberFormat; import java.text.NumberFormat;
@ -137,6 +138,9 @@ public final class CurrencyConverter extends ThreadedModule {
if (EXCHANGE_RATES.isEmpty()) { if (EXCHANGE_RATES.isEmpty()) {
try { try {
final SAXBuilder builder = new SAXBuilder(); final SAXBuilder builder = new SAXBuilder();
// See https://rules.sonarsource.com/java/tag/owasp/RSPEC-2755
builder.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
builder.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
builder.setIgnoringElementContentWhitespace(true); builder.setIgnoringElementContentWhitespace(true);
final Document doc = builder.build(new URL(EXCHANGE_TABLE_URL)); final Document doc = builder.build(new URL(EXCHANGE_TABLE_URL));

6
version.properties
View file

@ -1,9 +1,9 @@
#Generated by the Semver Plugin for Gradle #Generated by the Semver Plugin for Gradle
#Wed Mar 18 15:07:49 PDT 2020 #Wed Mar 18 15:45:11 PDT 2020
version.buildmeta=574 version.buildmeta=579
version.major=0 version.major=0
version.minor=7 version.minor=7
version.patch=3 version.patch=3
version.prerelease=beta version.prerelease=beta
version.project=mobibot version.project=mobibot
version.semver=0.7.3-beta+574 version.semver=0.7.3-beta+579