Security

This release addresses denial-of-service vulnerabilities when parsing malicious property lists. Applications that process untrusted property lists should upgrade to 1.30.

• Hardened binary property list parsing with bounds, length, offset-table, and object-reference validation for malformed or truncated input.
• Limited binary and XML property lists to 512 nested objects to prevent stack overflows from excessively nested input.

Thanks to @0xsakthi for reporting the vulnerabilities in #104.

Added

• Added a security policy and the public keys used to verify releases.
• Added a changelog.

Maven

<dependency>
  <groupId>com.googlecode.plist</groupId>
  <artifactId>dd-plist</artifactId>
  <version>1.30</version>
</dependency>

Full changelog: v1.29.0...v1.30.0

Fixed

• Added missing module-info to the package

Added

• NSObjects.getLocationInformation() provides information about an object's location within the parsed property list file (e.g. line number)
• PropertyListFormatException.getLocationInformation() provides information about where the parsing error occurred
• Added module-info to improve usability of this library for Java 9 and later

Improved

• PropertyListFormatException's messages now include more detailed information about where the parsing error occurred

This release contains several important bugfixes related to malformed property lists that could cause endless loops and undocumented exceptions.

Features

• Added support for storing null objects in NSSet
• All NSObjects now implement Comparable<NSObject>
• Improved parsing of binary property lists containing multiple references to the same object instance
• Added support for Base64 NSData representation in GNUstep ASCII property lists (Issue #57)
• Added support for creating UID instances from BigInteger instances (Issue #38)

Bugfixes

• Fix support of infinity values in XML property lists (Issue #83)
• Fixed NullPointerException when calling equals(null) on some NSObjects
• Fixed various undocumented exceptions caused by invalid property lists (Issues #73 and #74)
• Fixed endless loops caused by invalid ASCII property lists

Bug Fixes / Improvements

• Reduced unnecessary memory allocation when parsing binary property lists, which could cause OutOfMemoryErrors when handling corrupted files (Issue #72)

What's Changed

• XML and ASCII parser improvements for reading data from String/Reader by @jpstotz in #71
• Moved methods related to writing and converting property lists into separate classes: ASCIIPropertyListWriter, BinaryPropertyListWriter, XMLPropertyListWriter and PropertyListConverter. The old methods for saving and converting in PropertyListParser have been marked as deprecated.
• Added method overloads for reading/writing property lists using java.nio.file.Path instances

New Contributors

• @jpstotz made their first contribution in #71

Full Changelog: v1.24.0...v1.25.0

What's Changed

• Updated to Java 8
• Parsing XML property lists from InputStreams no longer closes the InputStream (Issue #55)
• Fixed invalid XML property lists being created when NSString instances contained characters that are illegal in an XML document
• Fixed toJavaObject() not working for NSData (Issue #59)
• Fixed ArrayIndexOutOfBoundsException when parsing certain ASCII property lists (Issue #67)
• Fixed parsing of ASCII and XML property lists that are encoded in UTF-16 or UTF-32

Full Changelog: dd-plist-1.23...v1.24.0

Changes since version 1.22:

• Added support for parsing and encoding NSNumbers with the value NaN (Issue #54)

Changes since version 1.21:

• Fixed converting NSNumber instances created from integers to float or double (Issue #49)

Changes since version 1.20:

• All NSObject instances are now cloneable. Calling NSObject.clone() will return a deep copy of the object.
• Binary Property Lists
  • Fixed OutOfMemoryError when parsing binary property list files with an invalid object table (#42).
  • Improved exceptions that are thrown in case of a corrupted or invalid object table
• ASCII Property Lists
  • The text encoding that is used when parsing a property list can now be configured (#48, #47)
  • UTF-16 and UTF-32 encoded property lists with BOM are now automatically detected
  • Escaped single quotes are now properly unescaped (#45)
  • Improved exceptions that are thrown when encountering an invalid escape sequence