DetectVMInstallationsJob open network connection

[nitind]

On Eclipse 2023-09 (4.29), Temurin OpenJDK 17.0.4.1, macOS

In spite of the parser settings applied, the DetectVMInstallationsJob attempts to retrieve the DTD, which means opening a network connection to retrieve http://www.apple.com/DTDs/PropertyList-1.0.dtd for no benefit.

Thread [Worker-18: Look up for installed JVMs] (Suspended (breakpoint at line 1051 in HttpURLConnection))
HttpURLConnection.connect() line: 1051
HttpURLConnection.getInputStream0() line: 1665
HttpURLConnection.getInputStream() line: 1589
XMLEntityManager.setupCurrentEntity(boolean, String, XMLInputSource, boolean, boolean) line: 677
XMLEntityManager.startEntity(boolean, String, XMLInputSource, boolean, boolean) line: 1397
XMLEntityManager.startDTDEntity(XMLInputSource) line: 1363
XMLDTDScannerImpl.setInputSource(XMLInputSource) line: 257
XMLDocumentScannerImpl$DTDDriver.dispatch(boolean) line: 1152
XMLDocumentScannerImpl$DTDDriver.next() line: 1040
XMLDocumentScannerImpl$PrologDriver.next() line: 943
XMLDocumentScannerImpl.next() line: 605
XMLDocumentScannerImpl(XMLDocumentFragmentScannerImpl).scanDocument(boolean) line: 542
XIncludeAwareParserConfiguration(XML11Configuration).parse(boolean) line: 889
XIncludeAwareParserConfiguration(XML11Configuration).parse(XMLInputSource) line: 825
DOMParser(XMLParser).parse(XMLInputSource) line: 141
DOMParser.parse(InputSource) line: 247
DocumentBuilderImpl.parse(InputSource) line: 342
PListParser.parseXML(InputStream) line: 104
PListParser.parse(InputStream) line: 67
MacInstalledJREs.parseJREInfo(InputStream, IProgressMonitor) line: 160
MacInstalledJREs.parseJREInfo(IProcess, IProgressMonitor) line: 143
MacInstalledJREs.getInstalledJREs(IProgressMonitor) line: 113
DetectVMInstallationsJob.run(IProgressMonitor) line: 67
Worker.run() line: 63

[jukzi]

Would you please extend the junit test org.eclipse.pde.core.tests.internal.PDEXmlProcessorFactoryTest.testDocumentBuilderIgnoringDoctypeMalcious() / createMalciousXml with testdata that shows the error. If createDocumentBuilderIgnoringDOCTYPE still can be missused other usages might also need a fix.

[jukzi]

@nitind can you please provide an example xml which opens a network connection?

[jukzi]

i found an example here: https://developer.apple.com/forums/thread/6846

[nitind]

From an actual system:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
	<dict>
		<key>JVMArch</key>
		<string>x86_64</string>
		<key>JVMBundleID</key>
		<string>net.java.openjdk.jdk</string>
		<key>JVMEnabled</key>
		<true/>
		<key>JVMHomePath</key>
		<string>/Library/Java/JavaVirtualMachines/temurin-17.jdk/Contents/Home</string>
		<key>JVMName</key>
		<string>OpenJDK 17.0.4.1</string>
		<key>JVMPlatformVersion</key>
		<string>17.0.4.1</string>
		<key>JVMVendor</key>
		<string>Eclipse Adoptium</string>
		<key>JVMVersion</key>
		<string>17.0.4.1</string>
	</dict>
</array>
</plist>