checkstyle security vulnerability

[olyutorskii]

checkstyle before 8.18 has XXE vulnerability.
JarabraDix uses checkstyle reporting with Maven site.

CVE-2019-9658

checkstyle issue
Disable loading external DTDs by default, create system property to activate it

[olyutorskii]

=== You've Got Mail ===

.....

Date: Thu, 14 Mar 2019 15:44:15 +0000 (UTC)
From: GitHub
Subject: [olyutorskii/JarabraDix] One of your dependencies may have a security
vulnerability

olyutorskii,
We found a potential security vulnerability in a repository for which you have been granted security alert access.

olyutorskii/JarabraDix
https://github.com/olyutorskii/JarabraDix
Known moderate severity security vulnerability in com.puppycrawl.tools:checkstyle v< 8.18, defined in https://github.com/olyutorskii/JarabraDix/blob/master/pom.xml

pom.xml update suggested: com.puppycrawl.tools:checkstyle v8.18

.....

[olyutorskii]

JEP 185: Restrict Fetching of External XML Resources

XML External Entity (XXE) Processing (OWASP)

XML external entity attack (Wikipedia)