Merge branch 'security' into security-rc

Conflicts:
	core/src/main/java/hudson/PluginManager.java
	core/src/test/java/hudson/PluginManagerTest.java

core/src/test/java/hudson/PluginManagerTest.java

@@ -26,11 +26,14 @@ package hudson;
 
 import org.apache.tools.ant.filters.StringInputStream;
 import org.junit.Test;
-
-
+import org.xml.sax.SAXException;
+import java.io.IOException;
+import static org.hamcrest.core.IsInstanceOf.instanceOf;
+import static org.hamcrest.core.StringContains.containsString;
 import static org.junit.Assert.*;
 import org.junit.Rule;
 import org.junit.rules.TemporaryFolder;
+import org.jvnet.hudson.test.Issue;
 
 public class PluginManagerTest {
 
@@ -41,4 +44,28 @@ public class PluginManagerTest {
                 .parseRequestedPlugins(new StringInputStream("<root><stuff plugin='stuff@1.0'><more plugin='other@2.0'><things plugin='stuff@1.2'/></more></stuff></root>")).toString());
     }
 
+    @Issue("SECURITY-167")
+    @Test
+    public void parseInvalidRequestedPlugins() throws Exception {
+        String evilXML = "<?xml version='1.0' encoding='UTF-8'?>\n" +
+                "<!DOCTYPE project[<!ENTITY foo SYSTEM \"file:///\">]>\n" +
+                "<root>\n" +
+                "  <stuff plugin='stuff@1.0'>\n" +
+                "&foo;" +
+                "    <more plugin='other@2.0'>\n" +
+                "      <things plugin='stuff@1.2'/>\n" +
+                "    </more>\n" +
+                "  </stuff>\n" +
+                "</root>\n";
+
+        PluginManager pluginManager = new LocalPluginManager(Util.createTempDir());
+        try {
+            pluginManager.parseRequestedPlugins(new StringInputStream(evilXML));
+            fail("XML contains an external entity, but no exception was thrown.");
+        }
+        catch (IOException ex) {
+            assertThat(ex.getCause(), instanceOf(SAXException.class));
+            assertThat(ex.getCause().getMessage(), containsString("Refusing to resolve entity with publicId(null) and systemId (file:///)"));
+        }
+    }
 }