[HBASE-17424] Protect REST client against malicious XML responses.

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.3.0, 1.2.5, 1.1.9, 2.0.0
• Component/s: REST
• Assignee: Josh Elser
• Reporter: Josh Elser
• Created: 04/Jan/17 20:43
• Updated: 09/Nov/17 02:41
• Resolved: 06/Jan/17 23:40

Description

If, by some means, an unsuspecting REST server client would get a malformed response from the REST server, it could result in the client performing some unintended action from the XML parsing.

We should disable these extra options on the XML parser to prevent the possibility.

Issue Links

• relates to: HBASE-19020 TestXmlParsing exception checking relies on a particular xml implementation without declaring it.