fix for GRAILS-10793 "On Windows, grails v2.3.2 or 2.3.3 (new project…

…) adding BuildConfig dependencies results in plugin errors. Works on 2.3.1!"

grails-aether/src/main/groovy/org/codehaus/groovy/grails/resolve/maven/aether/AetherDependencyManager.groovy

@@ -90,6 +90,7 @@ import org.eclipse.aether.util.graph.transformer.ChainedDependencyGraphTransform
 import org.eclipse.aether.util.graph.transformer.JavaDependencyContextRefiner
 import org.codehaus.groovy.grails.resolve.maven.aether.support.ScopeAwareNearestVersionSelector
 import org.codehaus.groovy.grails.resolve.maven.aether.support.MultipleTopLevelJavaScopeSelector
+import org.codehaus.groovy.grails.io.support.IOUtils
 
 /**
  * An implementation of the {@link DependencyManager} interface that uses Aether, the dependency resolution
@@ -227,7 +228,7 @@ class AetherDependencyManager implements DependencyManager {
         if(report.allArtifacts) {
             File pluginXml = report.allArtifacts.find { File f -> f.name.endsWith('-plugin.xml')}
 
-            return new XmlSlurper().parse(pluginXml)
+            return IOUtils.createXmlSlurper().parse(pluginXml)
         }
 
         return null

grails-bootstrap/src/main/groovy/grails/util/PluginBuildSettings.groovy

@@ -32,6 +32,10 @@ import org.codehaus.groovy.grails.plugins.CompositePluginDescriptorReader
 import org.codehaus.groovy.grails.plugins.GrailsPluginInfo
 import org.codehaus.groovy.grails.plugins.PluginInfo
 import org.codehaus.groovy.grails.plugins.build.scopes.PluginScopeInfo
+import javax.xml.parsers.SAXParserFactory
+import groovy.xml.FactorySupport
+import javax.xml.parsers.ParserConfigurationException
+import javax.xml.XMLConstants
 
 /**
  * Uses the project BuildSettings object to discover information about the installed plugin
@@ -344,7 +348,7 @@ class PluginBuildSettings {
      */
     GPathResult getMetadataForPlugin(Resource pluginDir) {
         try {
-            return new XmlSlurper().parse(new File("$pluginDir.file.absolutePath/plugin.xml"))
+            return IOUtils.createXmlSlurper().parse(new File("$pluginDir.file.absolutePath/plugin.xml"))
         }
         catch (e) {
             return null
@@ -749,7 +753,7 @@ class PluginBuildSettings {
             def zipFile = new ZipFile(zipLocation)
             ZipEntry entry = zipFile.entries().find {ZipEntry entry -> entry.name == 'plugin.xml'}
             if (entry) {
-                def pluginXml = new XmlSlurper().parse(zipFile.getInputStream(entry))
+                def pluginXml = grails.util.GrailsUtil.createXmlSlurper().parse(zipFile.getInputStream(entry))
                 def name = pluginXml.'@name'.text()
                 def release = pluginXml.'@version'.text()
                 return [name, release, pluginXml]
@@ -761,6 +765,7 @@ class PluginBuildSettings {
         return null
     }
 
+
     /**
      * Reads plugin info from the zip file location
      *

grails-bootstrap/src/main/groovy/org/codehaus/groovy/grails/cli/api/BaseSettingsApi.java

@@ -43,6 +43,7 @@
 import java.util.Map;
 import java.util.Properties;
 
+import groovy.xml.FactorySupport;
 import org.codehaus.groovy.grails.cli.ScriptExitException;
 import org.codehaus.groovy.grails.cli.support.GrailsBuildEventListener;
 import org.codehaus.groovy.grails.io.support.ClassPathResource;
@@ -52,6 +53,11 @@
 import org.codehaus.groovy.grails.io.support.Resource;
 import org.codehaus.groovy.grails.plugins.GrailsPluginUtils;
 import org.codehaus.groovy.runtime.MethodClosure;
+import org.xml.sax.SAXException;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParserFactory;
 
 /**
  * Utility methods used on the command line.
@@ -295,7 +301,7 @@ public GPathResult readPluginXmlMetadata(String pluginName) throws Exception {
         Resource pluginResource = pluginSettings.getPluginDirForName(pluginName);
         if (pluginResource != null) {
             File pluginDir = pluginResource.getFile();
-            return new XmlSlurper().parse(new File(pluginDir, "plugin.xml"));
+            return createXmlSlurper().parse(new File(pluginDir, "plugin.xml"));
         }
         return null;
     }
@@ -308,11 +314,24 @@ public List<GPathResult> readAllPluginXmlMetadata() throws Exception{
         List<GPathResult> results = new ArrayList<GPathResult>();
         for (Resource resource : allFiles) {
             if (resource.exists()) {
-                results.add( new XmlSlurper().parse(resource.getFile())  );
+                results.add(createXmlSlurper().parse(resource.getFile()));
             }
         }
         return results;
     }
+
+    public XmlSlurper createXmlSlurper() throws ParserConfigurationException, SAXException {
+        SAXParserFactory factory = FactorySupport.createSaxParserFactory();
+        factory.setNamespaceAware(true);
+        factory.setValidating(false);
+
+        try {
+            factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
+            factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        } catch (ParserConfigurationException pce) {
+        }
+        return new XmlSlurper(factory.newSAXParser());
+    }
     /**
      * Times the execution of a closure, which can include a target. For
      * example,

grails-bootstrap/src/main/groovy/org/codehaus/groovy/grails/cli/maven/MavenPomGenerator.groovy

@@ -26,6 +26,7 @@ import org.codehaus.groovy.grails.plugins.AstPluginDescriptorReader
 import org.codehaus.groovy.grails.plugins.GrailsPluginInfo
 import org.codehaus.groovy.grails.resolve.Dependency
 import org.codehaus.groovy.grails.resolve.DependencyManager
+import org.codehaus.groovy.grails.io.support.IOUtils
 
 /**
  * Generates a POM for a Grails application.
@@ -203,7 +204,7 @@ class MavenPomGenerator extends BaseSettingsApi {
     }
 
     protected Map getParentModel(File pomFile) {
-        def xml = new XmlSlurper().parse(pomFile)
+        def xml = IOUtils.createXmlSlurper().parse(pomFile)
         return [parent: [group: xml.groupId.text(), name: xml.artifactId.text(), version: xml.version.text()]]
     }
 

grails-bootstrap/src/main/groovy/org/codehaus/groovy/grails/io/support/IOUtils.java

@@ -15,6 +15,13 @@
  */
 package org.codehaus.groovy.grails.io.support;
 
+import groovy.util.XmlSlurper;
+import groovy.xml.FactorySupport;
+import org.xml.sax.SAXException;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParserFactory;
 import java.io.BufferedInputStream;
 import java.io.BufferedOutputStream;
 import java.io.ByteArrayInputStream;
@@ -342,4 +349,17 @@ public static String copyToString(Reader in) throws IOException {
         copy(in, out);
         return out.toString();
     }
+
+    public static XmlSlurper createXmlSlurper() throws ParserConfigurationException, SAXException {
+        SAXParserFactory factory = FactorySupport.createSaxParserFactory();
+        factory.setNamespaceAware(true);
+        factory.setValidating(false);
+
+        try {
+            factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
+            factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        } catch (ParserConfigurationException pce) {
+        }
+        return new XmlSlurper(factory.newSAXParser());
+    }
 }

grails-bootstrap/src/main/groovy/org/codehaus/groovy/grails/plugins/PluginInfo.groovy

@@ -19,6 +19,7 @@ import grails.util.PluginBuildSettings
 
 import groovy.util.slurpersupport.GPathResult
 import org.codehaus.groovy.grails.io.support.Resource
+import org.codehaus.groovy.grails.io.support.IOUtils
 
 /**
  * Used mainly by the build system that encapsulates access to information
@@ -54,7 +55,7 @@ class PluginInfo extends GroovyObjectSupport implements GrailsPluginInfo {
         InputStream input
         try {
             input = pluginXml.getInputStream()
-            return new XmlSlurper().parse(input)
+            return IOUtils.createXmlSlurper().parse(input)
         }
         finally { input?.close() }
     }

grails-bootstrap/src/main/groovy/org/codehaus/groovy/grails/resolve/DependencyManagerUtils.groovy

@@ -25,6 +25,7 @@ import javax.xml.parsers.ParserConfigurationException
 import org.xml.sax.ErrorHandler
 import org.xml.sax.SAXException
 import org.xml.sax.SAXParseException
+import org.codehaus.groovy.grails.io.support.IOUtils
 
 /**
  * Abstract implementation of DependencyManager interface
@@ -51,7 +52,7 @@ abstract class DependencyManagerUtils {
                     }
                 }
 
-                def xmlSlurper = new XmlSlurper()
+                def xmlSlurper = IOUtils.createXmlSlurper()
                 xmlSlurper.setErrorHandler(new ErrorHandler() {
                     void warning(SAXParseException e) { /*noop*/ }
                     void error(SAXParseException e) { /*noop*/ }

grails-bootstrap/src/main/groovy/org/codehaus/groovy/grails/resolve/IvyDependencyManager.groovy

@@ -44,6 +44,7 @@ import org.apache.ivy.plugins.repository.TransferListener
 import org.codehaus.groovy.grails.plugins.VersionComparator
 import org.codehaus.groovy.grails.resolve.ivy.IvyGraphNode
 import org.codehaus.groovy.grails.resolve.reporting.SimpleGraphRenderer
+import org.codehaus.groovy.grails.io.support.IOUtils
 
 /**
  * Implementation that uses Apache Ivy under the hood.
@@ -121,7 +122,7 @@ class IvyDependencyManager extends AbstractIvyDependencyManager implements Depen
                         def input
                         try {
                             input = res.openStream()
-                            return new XmlSlurper().parse(input)
+                            return IOUtils.createXmlSlurper().parse(input)
                         }
                         finally {
                             input.close()
@@ -151,7 +152,7 @@ class IvyDependencyManager extends AbstractIvyDependencyManager implements Depen
                 return null
             }
 
-            return new XmlSlurper().parse(report.getArtifactsReports(null, false).localFile.first())
+            return IOUtils.createXmlSlurper().parse(report.getArtifactsReports(null, false).localFile.first())
         }
         return null
     }

grails-bootstrap/src/main/groovy/org/codehaus/groovy/grails/resolve/PluginInstallEngine.groovy

@@ -33,6 +33,7 @@ import org.codehaus.groovy.grails.plugins.GrailsPluginInfo
 import org.codehaus.groovy.grails.plugins.GrailsPluginUtils
 import org.codehaus.groovy.grails.plugins.GrailsVersionUtils
 import org.codehaus.groovy.grails.cli.interactive.InteractiveMode
+import org.codehaus.groovy.grails.io.support.IOUtils
 
 /**
  * Manages the installation and uninstallation of plugins from a Grails project.
@@ -310,7 +311,7 @@ class PluginInstallEngine {
             errorHandler("Plugin $fullPluginName is not a valid Grails plugin. No plugin.xml descriptor found!")
         }
 
-        def pluginXml = new XmlSlurper().parse(pluginXmlFile)
+        def pluginXml = IOUtils.createXmlSlurper().parse(pluginXmlFile)
         def pluginName = pluginXml.@name.toString()
         def pluginVersion = pluginXml.@version.toString()
         def pluginGrailsVersion = pluginXml.@grailsVersion.toString()

grails-bootstrap/src/main/groovy/org/codehaus/groovy/grails/resolve/PluginResolveEngine.groovy

@@ -18,6 +18,7 @@ package org.codehaus.groovy.grails.resolve
 import grails.build.logging.GrailsConsole
 import grails.util.BuildSettings
 import groovy.util.slurpersupport.GPathResult
+import org.codehaus.groovy.grails.io.support.IOUtils
 
 /**
  * Utility methods for resolving plugin zips and information
@@ -62,7 +63,7 @@ Plugins must be declared in the grails-app/conf/BuildConfig.groovy file.
             }
             try {
                 final String text = new URL("$url?format=xml").getText(connectTimeout: 500, readTimeout: 3000)
-                pluginXml = new XmlSlurper().parseText(text)
+                pluginXml = IOUtils.createXmlSlurper().parseText(text)
                 if (!version) {
                     version = pluginXml.version.text()
                 }

grails-bootstrap/src/main/groovy/org/codehaus/groovy/grails/resolve/config/RepositoriesConfigurer.groovy

@@ -28,6 +28,7 @@ import org.apache.ivy.util.Message
 import org.codehaus.groovy.grails.resolve.GrailsPluginsDirectoryResolver
 import org.codehaus.groovy.grails.resolve.GrailsRepoResolver
 import org.codehaus.groovy.grails.resolve.SnapshotAwareM2Resolver
+import org.codehaus.groovy.grails.io.support.IOUtils
 
 class RepositoriesConfigurer extends AbstractDependencyManagementConfigurer {
 
@@ -250,7 +251,7 @@ class RepositoriesConfigurer extends AbstractDependencyManagementConfigurer {
 
                 File mavenSettingsFile = new File("${m2UserDir}/settings.xml")
                 if (mavenSettingsFile.exists()) {
-                    def settingsXml = new XmlSlurper().parse(mavenSettingsFile)
+                    def settingsXml = IOUtils.createXmlSlurper().parse(mavenSettingsFile)
                     String localRepository = getLocalRespository(settingsXml)
 
                     if (localRepository.trim()) {

grails-bootstrap/src/uaa/groovy/org/codehaus/groovy/grails/cli/support/UaaEnabler.groovy

@@ -25,6 +25,7 @@ import groovy.util.slurpersupport.GPathResult
 import org.codehaus.groovy.grails.plugins.GrailsPluginInfo
 import org.codehaus.groovy.grails.resolve.DependencyManager
 import org.codehaus.groovy.tools.LoaderConfiguration
+import org.codehaus.groovy.grails.io.support.IOUtils
 
 /**
  * Integrates UAA usage tracking with Grails.
@@ -122,7 +123,7 @@ Enter Y or N:"""
 
                         try {
                             input = centralURL.openStream()
-                            final GPathResult pluginList = new XmlSlurper().parse(input)
+                            final GPathResult pluginList = IOUtils.createXmlSlurper().parse(input)
 
                             final GrailsPluginInfo[] pluginInfos = pluginBuildSettings.getPluginInfos(pluginBuildSettings.getPluginDirPath())
                             for (GrailsPluginInfo pluginInfo : pluginInfos) {

grails-core/src/main/groovy/grails/util/GrailsUtil.java

@@ -18,7 +18,10 @@
 import groovy.lang.Binding;
 import groovy.lang.GroovyShell;
 import groovy.lang.Writable;
+import groovy.transform.CompileStatic;
+import groovy.util.XmlSlurper;
 import groovy.util.slurpersupport.GPathResult;
+import groovy.xml.FactorySupport;
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -37,7 +40,11 @@
 import org.springframework.core.io.support.PathMatchingResourcePatternResolver;
 import org.springframework.mock.web.MockServletContext;
 import org.springframework.util.Assert;
+import org.xml.sax.SAXException;
 
+import javax.xml.XMLConstants;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParserFactory;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.PrintWriter;
@@ -309,4 +316,6 @@ public static void writeSlurperResult(GPathResult result, Writer output) throws
                 " mkp.yield node}");
         w.writeTo(output);
     }
+
+
 }

grails-core/src/main/groovy/org/codehaus/groovy/grails/commons/GrailsApplicationFactoryBean.java

@@ -16,7 +16,6 @@
 package org.codehaus.groovy.grails.commons;
 
 import grails.util.Environment;
-import groovy.util.XmlSlurper;
 import groovy.util.slurpersupport.GPathResult;
 
 import java.io.InputStream;
@@ -27,6 +26,7 @@
 import org.apache.commons.logging.LogFactory;
 import org.codehaus.groovy.grails.compiler.GrailsClassLoader;
 import org.codehaus.groovy.grails.compiler.support.GrailsResourceLoader;
+import org.codehaus.groovy.grails.io.support.IOUtils;
 import org.codehaus.groovy.grails.plugins.GrailsPluginUtils;
 import org.springframework.beans.factory.FactoryBean;
 import org.springframework.beans.factory.InitializingBean;
@@ -61,7 +61,7 @@ public void afterPropertiesSet() throws Exception {
 
                 // Get all the resource nodes in the descriptor.
                 // Xpath: /grails/resources/resource, where root is /grails
-                GPathResult root = new XmlSlurper().parse(inputStream);
+                GPathResult root = IOUtils.createXmlSlurper().parse(inputStream);
                 GPathResult resources = (GPathResult) root.getProperty("resources");
                 GPathResult grailsClasses = (GPathResult) resources.getProperty("resource");
 

grails-core/src/main/groovy/org/codehaus/groovy/grails/plugins/CorePluginFinder.java

@@ -33,6 +33,7 @@
 import org.apache.commons.logging.LogFactory;
 import org.codehaus.groovy.grails.commons.GrailsApplication;
 import org.codehaus.groovy.grails.exceptions.GrailsConfigurationException;
+import org.codehaus.groovy.grails.io.support.IOUtils;
 import org.codehaus.groovy.grails.support.ParentApplicationContextAware;
 import org.springframework.context.ApplicationContext;
 import org.springframework.core.io.Resource;
@@ -118,7 +119,7 @@ private void loadCorePluginsFromResources(Resource[] resources) throws IOExcepti
 
         LOG.debug("Attempting to load [" + resources.length + "] core plugins");
         try {
-            XmlSlurper slurper = new XmlSlurper();
+            XmlSlurper slurper = IOUtils.createXmlSlurper();
             for (Resource resource : resources) {
                 InputStream input = null;
 

grails-core/src/main/groovy/org/codehaus/groovy/grails/plugins/GrailsPluginManagerFactoryBean.java

@@ -19,14 +19,14 @@
 import grails.util.BuildSettingsHolder;
 import grails.util.Holders;
 import groovy.lang.GroovyClassLoader;
-import groovy.util.XmlSlurper;
 import groovy.util.slurpersupport.GPathResult;
 
 import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.List;
 
 import org.codehaus.groovy.grails.commons.GrailsApplication;
+import org.codehaus.groovy.grails.io.support.IOUtils;
 import org.codehaus.groovy.grails.project.plugins.GrailsProjectPluginLoader;
 import org.springframework.beans.BeansException;
 import org.springframework.beans.factory.FactoryBean;
@@ -83,7 +83,7 @@ public void afterPropertiesSet() throws Exception {
                     inputStream = descriptor.getInputStream();
 
                     // Xpath: /grails/plugins/plugin, where root is /grails
-                    GPathResult root = new XmlSlurper().parse(inputStream);
+                    GPathResult root = IOUtils.createXmlSlurper().parse(inputStream);
                     GPathResult plugins = (GPathResult) root.getProperty("plugins");
                     GPathResult nodes = (GPathResult) plugins.getProperty("plugin");