Security Contact Requested

[prodigysml]

@n33dle and I found a security vulnerability within the quickfixj project. We were hoping to get a core maintainer's contact details to responsibly disclose this vulnerability.

[chrjohn]

Is it a vulnerability in quickfixj or a used library? However you can contact me on christoph.john-at-macd.com Thanks in advance

[chrjohn]

Hi @prodigysml , @n33dle
Did not receive an email yet. Are you maybe referring to this: #239 (Bump dom4j from 2.1.0 to 2.1.1 in /quickfixj-dictgenerator)
There were changes to prevent external entity injection.

https://github.com/dom4j/dom4j/blob/b408f43b5abc0b0f408819e620bd69e72248352f/src/main/java/org/dom4j/DocumentHelper.java#L271-L279

[chrjohn]

#239 has been merged now.
I can only assume that this was the issue.

[prodigysml]

Apologies for the delay. Yup I believe that was the vulnerability.

[prodigysml]

Just as an FYI, there is also this location:
https://github.com/quickfix-j/quickfixj/blob/master/quickfixj-core/src/main/java/quickfix/DataDictionary.java#L870-L874