jdaugherty opened a new issue, #412: URL: https://github.com/apache/grails-intellij-plugin/issues/412
## Summary `MvcPluginUtil` parses Grails plugin descriptor files (`plugin.xml`) and plugin list files (`plugins-list*.xml`) using a default JDOM `SAXBuilder` at `MvcPluginUtil.java:335` and `MvcPluginUtil.java:232`, respectively. Neither builder disables DOCTYPE declarations or external entity resolution, so a crafted `plugin.xml` containing an external DTD reference is parsed with entity expansion enabled. Any Grails project that ships a `plugin.xml` under a recognized plugin root can trigger the flaw once the user opens the Grails plugins dialog or invokes plugin-name code completion; the project need only be trusted, not otherwise suspicious to the user. ## Affected Component - **Component**: `MvcPluginUtil.parsePluginXml` / `MvcPluginUtil.parsePluginList` (unhardened `SAXBuilder`) — `plugins/groovy/mvc/org/jetbrains/plugins/groovy/mvc/plugins/MvcPluginUtil.java:335` and `:232`; reached from `MvcPluginsMain.java:439` (Grails plugins dialog) and `GrailsPluginNameCompletionContributor.java:91` (plugin-name code completion) - **Version**: IntelliJ IDEA Ultimate 2026.1.4 (build IU-261.26222.65) ## Impact A Grails project containing a plugin directory with a malicious `plugin.xml` (external DTD with parameter entities) causes the IDE to resolve attacker-controlled external entities the moment the user opens the Grails plugins dialog or triggers plugin-name completion. Direct impact: disclosure of local files readable by the IDE process (e.g., SSH private keys, cloud credential files, IDE configuration) and blind SSRF to attacker-controlled hosts. Chained impact: exfiltrated secrets can be used for account compromise or further lateral movement. ## Mitigation - **Fix**: Introduce a hardened `SAXBuilder` factory that sets the `http://apache.org/xml/features/disallow-doctype-decl` feature to `true` and disables the `http://xml.org/sax/features/external-general-entities` and `external-parameter-entities` features, then use it in both `parsePluginXml` and the `plugins-list*.xml` parser in `MvcPluginUtil`. The forms-compiler's `Utils.java` already implements this exact pattern and can be reused directly. - **Workaround**: None. ## References - CWE-611: Improper Restriction of XML External Entity Reference ('XXE') - CWE-827: Improper Control of Document Type Definition - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html --- *Imported from [IDEA-391392](https://youtrack.jetbrains.com/issue/IDEA-391392) · Type: Security Problem · Votes: 0* *Comments, attachments, dates and reporter are not part of the export — follow the link above for the full history.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
