Fix importer vulnerability #4240

nicksw · 2018-07-29T15:49:54Z

Fixed issue where importer was vulnerable to XXE attacks by
disabling DTDs. If feature is unavailable, warning is sent to logger and returns builderFactory at current state. Used #4229

Change in CHANGELOG.md described
Tests created for changes
Manually tested changed features in running JabRef
Screenshots added in PR description (for bigger UI changes)
Ensured that the git commit message is a good one
Check documentation status (Issue created for outdated help page at help.jabref.org?)

Fixed issue JabRef#4229 where importer was vulnerable to XXE attacks by disabling DTDs along with adding warning to logger if features are unavailable. fixes JabRef#4229

Siedlerchr · 2018-07-29T16:39:20Z

Thanks for your contribution
I just resolved the conflict in the changelog, so that the build runs on Travis. Check the Continous Interation Travis output (just click on it, in case it fails)

Siedlerchr · 2018-07-29T16:42:09Z

src/main/java/org/jabref/logic/importer/fileformat/MsBibImporter.java

 /**
 * Importer for the MS Office 2007 XML bibliography format
- * By S. M. Mahbub Murshed
+ * By S. M. Mahbub Murshed & Nicholas S. Weatherley


Pleas remove this author comment completely as we handle author credits via our authors-file

Siedlerchr · 2018-07-29T16:44:00Z

src/main/java/org/jabref/logic/importer/fileformat/MsBibImporter.java

+    private DocumentBuilderFactory makeSafeDocBuilderFactory(DocumentBuilderFactory dBuild) {
+        String FEATURE = null;
+        try {
+            FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";


Just some minor improvemtns: I would suggest extracting both urls to two separate variables and make them private static final as constants.

Siedlerchr · 2018-07-29T16:45:06Z

src/main/java/org/jabref/logic/importer/fileformat/MsBibImporter.java

+            dBuild.setExpandEntityReferences(false);
+
+        } catch (ParserConfigurationException e) {
+            LOGGER.warn("Builder not fully configured. ParserConfigurationException was thrown. Feature:'" +


slf4j has the nice advantage that it supports variables via curly braces:
https://www.slf4j.org/faq.html#logging_performance

and please add the exception as a parameter so that the root cause is also logged. (then probably the part "ParserConfigurationException was thrown." is no longer necessary).

Siedlerchr

Thanks again for your contribtution, just some minor code improvements 👍

tobiasdiez

Thanks for your contribution! The code looks good but I join the nitpicking party. Please fix these minor things and then we can merge your PR.

tobiasdiez · 2018-07-29T20:10:52Z

CHANGELOG.md

@@ -60,7 +60,8 @@ We refer to [GitHub issues](https://github.com/JabRef/jabref/issues) by using `#
 - We fixed an issue where the "Convert to BibTeX-Cleanup" moved the content of the `file` field to the `pdf` field [#4120](https://github.com/JabRef/jabref/issues/4120)
 - We fixed an issue where the preview pane in entry preview in preferences wasn't showing the citation style selected [#3849](https://github.com/JabRef/jabref/issues/3849)
 - We fixed an issue where the default entry preview style still contained the field `review`. The field `review` in the style is now replaced with comment to be consistent with the entry editor [#4098](https://github.com/JabRef/jabref/issues/4098)
- We fixed an issue where filles added via the "Attach file" contextmenu of an entry were not made relative. [#4201](https://github.com/JabRef/jabref/issues/4201)
+- We an issue where users were vulnerable to XXE attacks during parsing [#4229](https://github.com/JabRef/jabref/issues/4229)


We fixed an...

tobiasdiez · 2018-07-29T20:13:56Z

src/main/java/org/jabref/logic/importer/fileformat/MsBibImporter.java

+     * @return If supported, XXE safe DocumentBuilderFactory. Else, returns original builder given
+     */
+    private DocumentBuilderFactory makeSafeDocBuilderFactory(DocumentBuilderFactory dBuild) {
+        String FEATURE = null;


We have the convention that only static (constant) values are all capitals. Thus, please change the name to feature.

tobiasdiez · 2018-07-29T20:15:42Z

src/main/java/org/jabref/logic/importer/fileformat/MsBibImporter.java

+            dBuild.setExpandEntityReferences(false);
+
+        } catch (ParserConfigurationException e) {
+            LOGGER.warn("Builder not fully configured. ParserConfigurationException was thrown. Feature:'" +


and please add the exception as a parameter so that the root cause is also logged. (then probably the part "ParserConfigurationException was thrown." is no longer necessary).

Removed author line in class comment. Reworded CHANGLOG.md. Set DTD features to individual final static constants. Optimized logger by parameterizing feature and error.

…into fix-for-issue-4229

nicksw · 2018-07-30T00:46:20Z

Thanks for the feedback. Yes, I agree with all of the fixes. Sorry about the two commits back to back. The first one stated it did not go through on my end as I needed to update HEAD. Also, I am not sure why I am failing both tests. the CI test seems to be related to GUI errors while the Codacy fail is from the extra space before importing items from slf4j.

Siedlerchr · 2018-07-30T07:24:32Z

The Travis CI log raises a check style issue, so just some code formatting and the wrong import order. Although it might seem annoying, but it serves the purpose to have consistent code style and to avoid unnecessary conflicts between files

Both for intellij and Eclipse we provide the correct code format layout. In Eclipse hit ctrl + f to format and ctrl + o for the import order fix

nicksw · 2018-07-30T13:59:04Z

No I agree. The project should be uniform in import and code style as it would look a mess without. Pushed the changes.

tobiasdiez

Thanks again for your contribution!

…tive * upstream/master: Update dependencies (#4251) Fix author list parser (#4169) (#4248) Solved #3823 File annotation (#4246) Fix importer vulnerability (#4240)

nicksw and others added 2 commits July 29, 2018 11:05

Fix importer vulnerability

57d3a8a

Fixed issue JabRef#4229 where importer was vulnerable to XXE attacks by disabling DTDs along with adding warning to logger if features are unavailable. fixes JabRef#4229

Merge branch 'master' into fix-for-issue-4229

7226483

Siedlerchr reviewed Jul 29, 2018

View reviewed changes

Siedlerchr requested changes Jul 29, 2018

View reviewed changes

Siedlerchr added the status: ready-for-review Pull Requests that are ready to be reviewed by the maintainers label Jul 29, 2018

tobiasdiez requested changes Jul 29, 2018

View reviewed changes

nicksw added 2 commits July 29, 2018 20:06

Fix minor code errors and logger optimization

87a7682

Removed author line in class comment. Reworded CHANGLOG.md. Set DTD features to individual final static constants. Optimized logger by parameterizing feature and error.

Merge branch 'fix-for-issue-4229' of https://github.com/nicksw/jabref …

66396a0

…into fix-for-issue-4229

Rearrange import statments for project compatibility

11da233

Siedlerchr approved these changes Jul 30, 2018

View reviewed changes

Remove merge artefacts from changelog

cd3dd60

tobiasdiez approved these changes Jul 30, 2018

View reviewed changes

tobiasdiez merged commit 89f855d into JabRef:master Jul 30, 2018

nicksw deleted the fix-for-issue-4229 branch August 4, 2018 12:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix importer vulnerability #4240

Fix importer vulnerability #4240

nicksw commented Jul 29, 2018

Siedlerchr commented Jul 29, 2018

Siedlerchr Jul 29, 2018

Siedlerchr Jul 29, 2018

Siedlerchr Jul 29, 2018

tobiasdiez Jul 29, 2018

Siedlerchr left a comment

tobiasdiez left a comment

tobiasdiez Jul 29, 2018

tobiasdiez Jul 29, 2018

tobiasdiez Jul 29, 2018

nicksw commented Jul 30, 2018

Siedlerchr commented Jul 30, 2018

nicksw commented Jul 30, 2018

tobiasdiez left a comment

Fix importer vulnerability #4240

Fix importer vulnerability #4240

Conversation

nicksw commented Jul 29, 2018

Siedlerchr commented Jul 29, 2018

Siedlerchr Jul 29, 2018

Choose a reason for hiding this comment

Siedlerchr Jul 29, 2018

Choose a reason for hiding this comment

Siedlerchr Jul 29, 2018

Choose a reason for hiding this comment

tobiasdiez Jul 29, 2018

Choose a reason for hiding this comment

Siedlerchr left a comment

Choose a reason for hiding this comment

tobiasdiez left a comment

Choose a reason for hiding this comment

tobiasdiez Jul 29, 2018

Choose a reason for hiding this comment

tobiasdiez Jul 29, 2018

Choose a reason for hiding this comment

tobiasdiez Jul 29, 2018

Choose a reason for hiding this comment

nicksw commented Jul 30, 2018

Siedlerchr commented Jul 30, 2018

nicksw commented Jul 30, 2018

tobiasdiez left a comment

Choose a reason for hiding this comment