From 04b7f0a28cac8ed5b43ad7f806f6d38873dbd04e Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Sat, 12 Nov 2022 10:34:52 +0000 Subject: Disable external access when parsing XML --- src/main/java/org/zwobble/mammoth/internal/xml/parsing/SimpleSax.java | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/main/java/org') diff --git a/src/main/java/org/zwobble/mammoth/internal/xml/parsing/SimpleSax.java b/src/main/java/org/zwobble/mammoth/internal/xml/parsing/SimpleSax.java index 4e1b127..6a2950d 100644 --- a/src/main/java/org/zwobble/mammoth/internal/xml/parsing/SimpleSax.java +++ b/src/main/java/org/zwobble/mammoth/internal/xml/parsing/SimpleSax.java @@ -7,6 +7,7 @@ import org.xml.sax.XMLReader; import org.xml.sax.helpers.DefaultHandler; import org.zwobble.mammoth.internal.util.PassThroughException; +import javax.xml.XMLConstants; import javax.xml.parsers.ParserConfigurationException; import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; @@ -31,6 +32,9 @@ class SimpleSax { SAXParserFactory parserFactory = SAXParserFactory.newInstance(); parserFactory.setNamespaceAware(true); try { + parserFactory.setFeature("http://xml.org/sax/features/external-general-entities", false); + parserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + parserFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false); SAXParser saxParser = parserFactory.newSAXParser(); XMLReader xmlReader = saxParser.getXMLReader(); xmlReader.setContentHandler(new DefaultHandler() { -- cgit v1.2.3