CVE-2023-4218 (Java, published 2023-11-09T09:15Z)
Description: value: In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Severity: nan (CVSS v3 base score: 5)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/eclipse-jdt/eclipse.jdt.core
Files changed:
org.eclipse.jdt.apt.core/META-INF/MANIFEST.MF
org.eclipse.jdt.apt.core/src/org/eclipse/jdt/apt/core/internal/util/FactoryPathUtil.java
org.eclipse.jdt.apt.ui/META-INF/MANIFEST.MF
org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLComparer.java
org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLConverter.java
org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/negative/NegativeModelProc.java
org.eclipse.jdt.core.internal.tools/META-INF/MANIFEST.MF
org.eclipse.jdt.core.internal.tools/src/org/eclipse/jdt/core/internal/tools/unicode/TableBuilder.java
org.eclipse.jdt.core.tests.builder/META-INF/MANIFEST.MF
org.eclipse.jdt.core.tests.compiler/META-INF/MANIFEST.MF
org.eclipse.jdt.core.tests.model/META-INF/MANIFEST.MF
org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/formatter/DecodeCodeFormatterPreferences.java
org.eclipse.jdt.core.tests.performance/META-INF/MANIFEST.MF
org.eclipse.jdt.core/META-INF/MANIFEST.MF
org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaModelManager.java
org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaProject.java
org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/UserLibrary.java
org.eclipse.jdt.tests.latestBREE/META-INF/MANIFEST.MF
Commit message: Refactor XML parsing

Vulnerable code:
 org.eclipse.core.runtime;bundle-version="[3.5.100,4.0.0)",
			DocumentBuilder parser =
				DocumentBuilderFactory.newInstance().newDocumentBuilder();
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
		Document actualModel = factory.newDocumentBuilder().newDocument();
        Document expectedModel = factory.newDocumentBuilder().parse(source);
		TransformerFactory tf = TransformerFactory.newInstance();
		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
		Document model = factory.newDocumentBuilder().newDocument();
import javax.xml.parsers.DocumentBuilderFactory;
    	DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        Document expectedModel = factory.newDocumentBuilder().parse(source);
Require-Bundle: org.eclipse.jdt.core.compiler.batch;bundle-version="3.35.0"
			saxParser = SAXParserFactory.newInstance().newSAXParser();
		} catch (ParserConfigurationException e) {
			e.printStackTrace();
			return null;
		} catch (SAXException e) {
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
import javax.xml.parsers.SAXParserFactory;
			SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
			SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.13.0,4.0.0)",
import javax.xml.parsers.DocumentBuilderFactory;
					DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
import javax.xml.parsers.DocumentBuilderFactory;
			DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
					DocumentBuilderFactory.newInstance().newDocumentBuilder();
import javax.xml.parsers.DocumentBuilderFactory;
			DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
 org.eclipse.core.runtime;bundle-version="[3.2.0,4.0.0)",

Fixed code:
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
import org.eclipse.core.internal.runtime.XmlProcessorFactory;
			@SuppressWarnings("restriction")
			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory
					.createDocumentBuilderWithErrorOnDOCTYPE();
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
		Document actualModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
        Document expectedModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().parse(source);
		TransformerFactory tf = org.eclipse.core.internal.runtime.XmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
		Document model = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
        Document expectedModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().parse(source);
Require-Bundle: org.eclipse.jdt.core.compiler.batch;bundle-version="3.35.0",
 org.eclipse.core.runtime;bundle-version="3.29.0"
			@SuppressWarnings("restriction")
			SAXParser p = org.eclipse.core.internal.runtime.XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
			saxParser =p;
		} catch (SAXException | ParserConfigurationException e) {
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
import org.eclipse.core.internal.runtime.XmlProcessorFactory;
			SAXParser saxParser = XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
			SAXParser saxParser = XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",
					@SuppressWarnings("restriction")
					DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
			@SuppressWarnings("restriction")
			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
				@SuppressWarnings("restriction")
						org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
			@SuppressWarnings("restriction")
			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 org.eclipse.core.runtime;bundle-version="[3.29.0,4.0.0)",