[HDFS-16410] Insecure Xml parsing in OfflineEditsXmlLoader

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.3.1
• Fix Version/s: 3.4.0, 2.10.2, 3.2.3, 3.3.2
• Labels: pull-request-available security
• Assignee: Ashutosh Gupta
• Reporter: Ashutosh Gupta
• Created: 04/Jan/22 12:35
• Updated: 27/Sep/22 06:42
• Resolved: 05/Jan/22 18:02

Description

Insecure Xml parsing in OfflineEditsXmlLoader 

https://github.com/apache/hadoop/blob/03cfc852791c14fad39db4e5b14104a276c08e59/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/tools/offlineEditsViewer/OfflineEditsXmlLoader.java#L88

Issue Links

• relates to: HDFS-16766 hdfs ec command loads (administrator provided) erasure code policy files without disabling xml entity expansion
• links to: GitHub Pull Request #3854