Security Vulnerability - Action Required: XXE vulnerability in the newest version of the Mycat-Server

[Crispy-fried-chicken]

1、bug描述 我发现您的项目中src/main/java/io/mycat/config/loader/xml/XMLServerLoader.java文件中的io.mycat.config.util.ConfigUtil.getDocument(final InputStream dtd, InputStream xml)函数在创建factory对象的时候没有限制外部实体的使用，可能会造成外部实体注入漏洞，进而导致关键信息泄露的问题。当诸如load()等函数调用getDocument函数对xml文件进行分析时，如果这些xml文件被篡改，加入了外部实体，则容易导致外部实体注入，进而导致关键信息的泄露。

2、版本号(非常重要) 1.6.76-release-2020-11-2及以前的版本

3、参考漏洞信息

Vulnerability Detail: CVE Identifier: CVE-2021-21266 Description: openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity (XXE) attack allows attackers in the same network as the openHAB instance to retrieve internal information like the content of files from the file system. Responses to SSDP requests can be especially malicious. All add-ons that use SAX or JAXB parsing of externally received XML are potentially subject to this kind of attack. In openHAB, the following add-ons are potentially impacted: AvmFritz, BoseSoundtouch, DenonMarantz, DLinkSmarthome, Enigma2, FmiWeather, FSInternetRadio, Gce, Homematic, HPPrinter, IHC, Insteon, Onkyo, Roku, SamsungTV, Sonos, Roku, Tellstick, TR064, UPnPControl, Vitotronic, Wemo, YamahaReceiver and XPath Tranformation. The vulnerabilities have been fixed in versions 2.5.12 and 3.0.1 by a more strict configuration of the used XML parser. Reference:https://nvd.nist.gov/vuln/detail/CVE-2021-21266 Patch: https://github.com/openhab/openhab-addons/commit/81935b0ab126e6d9aebd2f6c3fc67d82bb7e8b86#diff-2e2b4fcc12c79d82a1d2cfda8f4279036d5a395c8777b3fb4adc219e85804092