Jdom2 XXE injection vulnerability

[ethauvin]

jdom2 is vulnerable to XML External Entity (XXE) Injection. See:

• https://snyk.io/vuln/SNYK-JAVA-ORGJDOM-1309669

jdom2 will most likely not be updated, an alternative should be found as already suggested in #455

[PatrickGotthard]

We disallow Doctype declarations by default. So this is only an issuewhen someone enables Doctype declarations.

[j-be]

@PatrickGotthard Would you mind going into more detail on how somebody would enable Doctype declarations in Rome, so we could check if we do (on purpose or by error)?

[PatrickGotthard]

Have a look at #203
You have to call setAllowDoctypes(true) on SyndFeedInput to allow Doctype declarations.

[j-be]

@PatrickGotthard Thanks for the clarification. That only applies when reading feeds, right? Are there any risks involved when creating feeds, e.g. disclosing files via:

<?xml  version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ELEMENT foo ANY >
   <!ENTITY xxe SYSTEM  "file:///etc/passwd" >]>
<foo>&xxe;</foo>

[PatrickGotthard]

Only when you create an XML bomb yourself and consume it yourself afterwards :D

[PatrickGotthard]

I've fixed the security issue and published version 1.16.0
It should be available in Maven Central soon.