check XXE libxml vulnerability

[Peter Baumann]

check the petascope XML parser against this exploit.
We need to make sure everytime an XML is parsed from an external source an XML parser with resolve_entities=False should be passed:

parser = etree.XMLParser(resolve_entities=False)

etree.fromstring(e, parser)
etree.parse(f, parser)

[Dimitar Misev]

can we get a status report?

[drusu]

Replying to dmisev:

can we get a status report?

We added the following into XMLUtil.java:
factory = SAXParserFactory.newInstance();

try{

factory.setFeature(FEATURE_XXE_FALSE, false);

}
catch(Exception e){

If feature does not exist ⇒ no XXE support anyway so nothing we need to do

};

I think this should work, but we have a problem while running the petascope project in netbeans. It doesnt want to deploy and i think this is because some properties from petascope were changed while creating the framework for testing ( another task ).
Once we fix the petascope I think it will work.

[Dimitar Misev]

You don't need to deploy petascope in NetBeans, you can (and you should) just make install it and deploy in Tomcat.