GP-6834 - Fix for xml dtd loading

Ghidra/Framework/Generic/src/main/java/ghidra/xml/ThreadedXmlPullParserImpl.java

@@ -62,6 +62,8 @@ class ThreadedXmlPullParserImpl extends AbstractXmlPullParser {
 	 * @param file the input XML file
 	 * @param errHandler the XML error handler
 	 * @param validate true if the parse should validate against the DTD
+	 * @param capacity the number of items that can be added to the queue before the parsing thread
+	 * will block
 	 * @throws SAXException if an XML parse error occurs
 	 * @throws IOException if an i/o error occurs
 	 */
@@ -76,6 +78,8 @@ class ThreadedXmlPullParserImpl extends AbstractXmlPullParser {
 	 * @param file the input XML file
 	 * @param errHandler the XML error handler
 	 * @param validate true if the parse should validate against the DTD
+	 * @param capacity the number of items that can be added to the queue before the parsing thread
+	 * will block
 	 * @throws SAXException if an XML parse error occurs
 	 * @throws IOException if an i/o error occurs
 	 */
@@ -96,14 +100,15 @@ class ThreadedXmlPullParserImpl extends AbstractXmlPullParser {
 	 * Note: Only use this method if you know that the XML in the given stream
 	 * contains its own internal validation (an internal dtd specification). For
 	 * XML files that use an external dtd file you should call
-	 * {@link #XmlParser(File, ErrorHandler, boolean)}.
+	 * {@link #ThreadedXmlPullParserImpl(File, ErrorHandler, boolean, int)}.
 	 * 
 	 * @param input the XML input stream
 	 * @param inputName the name of the input stream
 	 * @param errHandler the XML error handler
 	 * @param validate true if the parse should validate against the DTD
+	 * @param capacity the number of items that can be added to the queue before the parsing thread
+	 * will block
 	 * @throws SAXException if an XML parse error occurs
-	 * @throws IOException if an i/o error occurs
 	 */
 	ThreadedXmlPullParserImpl(InputStream input, String inputName, ErrorHandler errHandler,
 			boolean validate, int capacity) throws SAXException {
@@ -206,7 +211,6 @@ class ThreadedXmlPullParserImpl extends AbstractXmlPullParser {
 	public void dispose() {
 		disposed = true;
 		parsingTask.cancel(true);
-//		Msg.debug(this, id + "Disposed");
 	}
 
 	private class ContentHandlerRunnable implements Runnable {
@@ -223,15 +227,18 @@ class ThreadedXmlPullParserImpl extends AbstractXmlPullParser {
 
 			try {
 				SAXParserFactory saxParserFactory = XmlUtilities.createSecureSAXParserFactory(true);
+				saxParserFactory.setFeature(
+					"http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
 				saxParserFactory.setFeature("http://xml.org/sax/features/namespaces", false);
 				saxParserFactory.setFeature("http://xml.org/sax/features/validation", validate);
 				saxParser = saxParserFactory.newSAXParser();
 				saxParser.getXMLReader().setEntityResolver((publicId, systemId) -> {
 					if (resolveDir == null) {
-						return null;
+						return new InputSource(new StringReader("")); // empty DTD
 					}
-					ResourceFile resolvedFile =
-						new ResourceFile(resolveDir, new File(systemId).getName());
+
+					String filename = new File(systemId).getName();
+					ResourceFile resolvedFile = new ResourceFile(resolveDir, filename);
 					InputSource inputSource = new InputSource();
 					inputSource.setPublicId(publicId);
 					inputSource.setSystemId(resolvedFile.toURI().toString());

Ghidra/Framework/Generic/src/main/java/ghidra/xml/XmlPullParserFactory.java

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -15,13 +15,13 @@
  */
 package ghidra.xml;
 
-import generic.jar.ResourceFile;
-
 import java.io.*;
 
 import org.xml.sax.ErrorHandler;
 import org.xml.sax.SAXException;
 
+import generic.jar.ResourceFile;
+
 public class XmlPullParserFactory {
 	public static void setCreateTracingParsers(XmlTracer xmlTracer) {
 		throw new UnsupportedOperationException(
@@ -39,9 +39,11 @@ public class XmlPullParserFactory {
 	 *            the XML error handler
 	 * @param validate
 	 *            true if the parse should validate against the DTD
+	 * @return the parser
 	 * @throws SAXException
 	 *             if an XML parse error occurs
 	 * @throws IOException 
+	 *             if an i/o error occurs
 	 */
 	public static XmlPullParser create(InputStream input, String inputName,
 			ErrorHandler errHandler, boolean validate) throws SAXException, IOException {
@@ -57,6 +59,7 @@ public class XmlPullParserFactory {
 	 *            the XML error handler
 	 * @param validate
 	 *            true if the parse should validate against the DTD
+	 * @return the parser
 	 * @throws SAXException
 	 *             if an XML parse error occurs
 	 * @throws IOException
@@ -76,6 +79,7 @@ public class XmlPullParserFactory {
 	 *            the XML error handler
 	 * @param validate
 	 *            true if the parse should validate against the DTD
+	 * @return the parser
 	 * @throws SAXException
 	 *             if an XML parse error occurs
 	 * @throws IOException
@@ -97,6 +101,7 @@ public class XmlPullParserFactory {
 	 *            the XML error handler
 	 * @param validate
 	 *            true if the parse should validate against the DTD
+	 * @return the parser
 	 * @throws SAXException
 	 *             if an XML parse error occurs
 	 */

Ghidra/Framework/Generic/src/test/java/ghidra/xml/ThreadedXmlParserTest.java

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -44,17 +44,11 @@ public class ThreadedXmlParserTest extends AbstractGenericTest {
 		"<project name=\"foo\"/>" + "<project name=\"foo\"/>" + "<project name=\"foo\"/>" +
 		"<project name=\"foo\"/>" + "</doc>";
 
-	
 	private static final String XXE_XML = "<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n" +
 		"<!DOCTYPE foo [\n" + "    <!ELEMENT foo ANY >\n" +
 		"<!ENTITY xxe SYSTEM \"file://@TEMP_FILE@\">]><foo>&xxe; fizzbizz</foo>";
-	
-	public ThreadedXmlParserTest() {
-		super();
-	}
 
 	/**
-	 * <p>
 	 * XML External Entities attacks benefit from an XML feature to build documents dynamically at 
 	 * the time of processing.  An XML entity allows inclusion of data dynamically from a given 
 	 * resource.  External entities allow an XML document to include data from an external URI. 
@@ -71,7 +65,7 @@ public class ThreadedXmlParserTest extends AbstractGenericTest {
 	 * than ResourceFile) will use a default Entity Resolver. The XmlUtilities.createSecureSAXParserFactory 
 	 * factory configurations will disable external entities regardless of which Entity Resolver is used.
 	 * 
-	 * @throws Exception
+	 * @throws Exception if there is an exception
 	 */
 	@Test
 	public void testXXEXml() throws Exception {