MDS/openide
1
0
Fork 0
mirror of https://gitflic.ru/project/openide/openide.git synced 2026-09-27 10:03:11 +07:00
Code Issues Packages Projects Releases Wiki Activity

IDEA-173468 XXE vulnerability of handling log.xml: Content of local file can be sent to remote se...

Browse Source
This commit is contained in:
Dmitry Avdeev
2017-05-30 13:41:12 +03:00
parent c0a60d5f87
commit ae4ac3e29b
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
platform/platform-impl/src/com/intellij/idea/LoggerFactory.java
+7 -2
View File
@@ -17,14 +17,17 @@ package com.intellij.idea;
import com.intellij.openapi.application.PathManager;
import com.intellij.openapi.diagnostic.Logger;
import com.intellij.openapi.util.JDOMUtil;
import com.intellij.openapi.util.io.FileUtil;
import com.intellij.openapi.util.text.StringUtil;
import org.apache.log4j.LogManager;
import org.apache.log4j.xml.DOMConfigurator;
import org.jdom.Document;
import org.jdom.output.DOMOutputter;
import org.jetbrains.annotations.NotNull;
import org.w3c.dom.Element;
import java.io.File;
import java.io.StringReader;
@SuppressWarnings({"CallToPrintStackTrace", "UseOfSystemOutOrSystemErr"})
public class LoggerFactory implements Logger.Factory {
@@ -67,7 +70,9 @@ public class LoggerFactory implements Logger.Factory {
System.err.println("Cannot create log directory: " + file);
}
new DOMConfigurator().doConfigure(new StringReader(text), LogManager.getLoggerRepository());
Document document = JDOMUtil.loadDocument(text);
Element element = new DOMOutputter().output(document).getDocumentElement();
new DOMConfigurator().doConfigure(element, LogManager.getLoggerRepository());
myInitialized = true;
}