Skip to content

Commit 4cc2fbe

Browse files
committed
fix(maven): Use unlimited JAXP XML processing with Java >= 24
In Java >= 24, the default limit for processing XML entities was significantly lowered to 100000 bytes to protect against Entity Expansion / Billion Laughs Denial of Service attacks. Repeal that limit in the context of Tycho processing to avoid errors during analysis. Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.io>
1 parent 019abdf commit 4cc2fbe

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

  • plugins/package-managers/maven/src/main/kotlin/tycho

plugins/package-managers/maven/src/main/kotlin/tycho/Tycho.kt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -323,6 +323,9 @@ class Tycho(override val descriptor: PluginDescriptor = TychoFactory.descriptor)
323323
add("-DoutputFile=${dependencyTreeFile.absolutePath}")
324324
add("-DappendOutput=true")
325325
add("-Dverbose=true")
326+
// Use pre-Java-24 unlimited JAXP XML processing.
327+
add("-Djdk.xml.maxGeneralEntitySizeLimit=0")
328+
add("-Djdk.xml.totalEntitySizeLimit=0")
326329
}.toTypedArray()
327330
}
328331

0 commit comments

Comments
 (0)