Billion Laughs causes extension to consume all cpu and die

Fixes redhat-developer/vscode-xml#476

Signed-off-by: azerr <[email protected]>

org.eclipse.lemminx/src/main/java/org/eclipse/lemminx/extensions/contentmodel/participants/diagnostics/LSPXMLParserConfiguration.java

@@ -11,7 +11,12 @@
 *******************************************************************************/
 package org.eclipse.lemminx.extensions.contentmodel.participants.diagnostics;
 
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import org.apache.xerces.impl.Constants;
 import org.apache.xerces.impl.dtd.XMLDTDValidator;
+import org.apache.xerces.util.SecurityManager;
 import org.apache.xerces.xni.XMLDocumentHandler;
 import org.apache.xerces.xni.XNIException;
 import org.apache.xerces.xni.grammars.XMLGrammarPool;
@@ -37,6 +42,16 @@
  */
 class LSPXMLParserConfiguration extends XMLModelAwareParserConfiguration {
 
+	private static final Logger LOGGER = Logger.getLogger(LSPXMLParserConfiguration.class.getName());
+
+	/** property identifier: security manager. */
+	private static final String SECURITY_MANAGER = Constants.XERCES_PROPERTY_PREFIX
+			+ Constants.SECURITY_MANAGER_PROPERTY;
+	private static final String ENTITY_EXPANSION_LIMIT_PROPERTY_NAME = "jdk.xml.entityExpansionLimit";
+	private static final String MAX_OCCUR_LIMIT_PROPERTY_NAME = "jdk.xml.maxOccur";
+	private static final int ENTITY_EXPANSION_LIMIT_DEFAULT_VALUE = 64000;
+	private static final int MAX_OCCUR_LIMIT_DEFAULT_VALUE = 5000;
+
 	private final boolean disableDTDValidation;
 	private ExternalXMLDTDValidator externalDTDValidator;
 
@@ -51,8 +66,18 @@ public LSPXMLParserConfiguration(XMLGrammarPool grammarPool, boolean disableDTDV
 		// Resolve external entities if settings is set to true.
 		boolean resolveExternalEntities = validationSettings != null ? validationSettings.isResolveExternalEntities()
 				: false;
+		resolveExternalEntities = true;
 		super.setFeature("http://xml.org/sax/features/external-general-entities", resolveExternalEntities);
 		super.setFeature("http://xml.org/sax/features/external-parameter-entities", resolveExternalEntities);
+		if (resolveExternalEntities) {
+			// Security manager
+			SecurityManager securityManager = new SecurityManager();
+			securityManager.setEntityExpansionLimit(
+					getPropertyValue(ENTITY_EXPANSION_LIMIT_PROPERTY_NAME, ENTITY_EXPANSION_LIMIT_DEFAULT_VALUE));
+			securityManager.setMaxOccurNodeLimit(
+					getPropertyValue(MAX_OCCUR_LIMIT_PROPERTY_NAME, MAX_OCCUR_LIMIT_DEFAULT_VALUE));
+			super.setProperty(SECURITY_MANAGER, securityManager);
+		}
 		fErrorReporter = reporterForXML;
 	}
 
@@ -141,7 +166,17 @@ private void configureExternalDTDPipeline() {
 			// in the case of schema have some error (ex : syntax error)
 			AbstractLSPErrorReporter.initializeReporter(fSchemaValidator, getReporterForGrammar());
 		}
-
 	}
 
+	private static int getPropertyValue(String propertyName, int defaultValue) {
+		String value = System.getProperty(propertyName, "");
+		if (value.length() > 0) {
+			try {
+				return Integer.parseInt(value);
+			} catch (Exception e) {
+				LOGGER.log(Level.WARNING, "Error while getting system property '" + propertyName + "'.", e);
+			}
+		}
+		return defaultValue;
+	}
 }