Merge branch 'main' of https://github.com/meshtastic/ATAK-Plugin

Author: niccellular

app/src/main/java/com/atakmap/android/meshtastic/MeshtasticDropDownReceiver.java

@@ -30,6 +30,7 @@
 import com.atakmap.android.meshtastic.plugin.R;
 import com.atakmap.android.meshtastic.util.Constants;
 import com.atakmap.coremap.log.Log;
+import com.atakmap.coremap.filesystem.FileSystemUtils;
 import com.geeksville.mesh.ATAKProtos;
 import com.geeksville.mesh.AppOnlyProtos;
 import com.geeksville.mesh.ConfigProtos;
@@ -53,7 +54,6 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
-import java.io.OutputStream;
 import java.nio.ByteBuffer;
 import java.nio.ByteOrder;
 import java.util.ArrayList;
@@ -548,15 +548,22 @@ public void initModel() throws IOException {
         deleteContents(targetDir);
         copyAssets(assetManager, sourcePath, targetDir);
         // Copy uuid
-        copyFile(assetManager, sourcePath + "/uuid", targetDir);
+        FileSystemUtils.copyFromAssetsToStorageFile(
+            pluginContext,
+            sourcePath + "/uuid",
+            "tools/s2c/" + targetPath + "/" + sourcePath + "/uuid",
+            true
+        );
 
         this.model = new Model(resultPath);
         Log.d(TAG, "Model ready");
 
     }
 
     private static String readLine(InputStream is) throws IOException {
-        return new BufferedReader(new InputStreamReader(is)).readLine();
+        try (BufferedReader reader = new BufferedReader(new InputStreamReader(is))) {
+            return reader.readLine();
+        }
     }
 
     private static boolean deleteContents(File dir) {
@@ -596,19 +603,6 @@ private static void copyAssets(AssetManager assetManager, String path, File outP
         }
     }
 
-    private static void copyFile(AssetManager assetManager, String fileName, File outPath) throws IOException {
-        InputStream in;
-        in = assetManager.open(fileName);
-        OutputStream out = new FileOutputStream(outPath + "/" + fileName);
-
-        byte[] buffer = new byte[4000];
-        int read;
-        while ((read = in.read(buffer)) != -1) {
-            out.write(buffer, 0, read);
-        }
-        in.close();
-        out.close();
-    }
 
     public void recognizeMicrophone() {
         Log.d(TAG, "recognizeMicrophone");

app/src/main/java/com/atakmap/android/meshtastic/MeshtasticMapComponent.java

@@ -52,6 +52,8 @@
 
 import javax.xml.parsers.SAXParser;
 import javax.xml.parsers.SAXParserFactory;
+import javax.xml.XMLConstants;
+import com.atakmap.coremap.xml.XMLUtils;
 
 public class MeshtasticMapComponent extends DropDownMapComponent
         implements CommsMapComponent.PreSendProcessor,
@@ -403,6 +405,15 @@ private void handleGenericCotEvent(CotEvent cotEvent, int hopLimit, int channel)
                 exiResult.setOutputStream(osEXI);
 
                 SAXParserFactory saxParserFactory = SAXParserFactory.newInstance();
+                try {
+                    saxParserFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+                    saxParserFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+                    saxParserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+                    saxParserFactory.setFeature("http://xml.org/sax/features/validation", false);
+                    saxParserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+                } catch (Exception e) {
+                    Log.w(TAG, "Failed to configure secure SAXParserFactory", e);
+                }
                 SAXParser newSAXParser = saxParserFactory.newSAXParser();
                 XMLReader xmlReader = newSAXParser.getXMLReader();
                 xmlReader.setContentHandler(exiResult.getHandler());

app/src/main/java/com/atakmap/android/meshtastic/MeshtasticReceiver.java

@@ -94,6 +94,7 @@
 import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.sax.SAXSource;
 import javax.xml.transform.stream.StreamResult;
+import com.atakmap.coremap.xml.XMLUtils;
 
 public class MeshtasticReceiver extends BroadcastReceiver implements CotServiceRemote.CotEventListener {
     // constants
@@ -948,7 +949,7 @@ protected void receive(Intent intent) {
                     InputSource is = new InputSource(new ByteArrayInputStream(combined));
                     SAXSource exiSource = new EXISource(exiFactory);
                     exiSource.setInputSource(is);
-                    TransformerFactory tf = TransformerFactory.newInstance();
+                    TransformerFactory tf = XMLUtils.getTransformerFactory();
                     Transformer transformer = tf.newTransformer();
                     transformer.transform(exiSource, result);
                     CotEvent cotEvent = CotEvent.parse(writer.toString());
@@ -973,7 +974,7 @@ protected void receive(Intent intent) {
                     InputSource is = new InputSource(new ByteArrayInputStream(payload.getBytes()));
                     SAXSource exiSource = new EXISource(exiFactory);
                     exiSource.setInputSource(is);
-                    TransformerFactory tf = TransformerFactory.newInstance();
+                    TransformerFactory tf = XMLUtils.getTransformerFactory();
                     Transformer transformer = tf.newTransformer();
                     transformer.transform(exiSource, result);
                     CotEvent cotEvent = CotEvent.parse(writer.toString());