Fixed MXParser do not fail when encountering invalid characters in

comments (codehaus-plexus#126)
belingueres · Jan 21, 2021 · 8a05987 · 8a05987
1 parent 60bee8a
commit 8a05987
Show file tree

Hide file tree

Showing 35 changed files with 1,111 additions and 1 deletion.
diff --git a/src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java b/src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java
@@ -2865,6 +2865,19 @@ else if ( len == 4 && buf[posStart] == 'q' && buf[posStart + 1] == 'u' && buf[po
         }
     }
 
+    /**
+     * Check if the provided parameter is a valid Char, according to: {@link https://www.w3.org/TR/REC-xml/#NT-Char}
+     *
+     * @param codePoint the numeric value to check
+     * @return true if it is a valid numeric character reference. False otherwise.
+     */
+    private static boolean isValidCodePoint( int codePoint )
+    {
+        // Char ::= #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]
+        return codePoint == 0x9 || codePoint == 0xA || codePoint == 0xD || ( 0x20 <= codePoint && codePoint <= 0xD7FF )
+            || ( 0xE000 <= codePoint && codePoint <= 0xFFFD ) || ( 0x10000 <= codePoint && codePoint <= 0x10FFFF );
+    }
+
     private char[] lookuEntityReplacement( int entityNameLen )
         throws XmlPullParserException, IOException
 
@@ -2954,10 +2967,14 @@ else if ( ch == '>' )
                     }
                     seenDash = false;
                 }
-                else
+                else if (isValidCodePoint( ch ))
                 {
                     seenDash = false;
                 }
+                else
+                {
+                    throw new XmlPullParserException( "Illegal character 0x" + Integer.toHexString(((int) ch)) + " found in comment", this, null );
+                }
                 if ( normalizeIgnorableWS )
                 {
                     if ( ch == '\r' )