From 81111bc7df5a4d9bd86a8fcc1190f30064863642 Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Sun, 17 Mar 2024 18:00:27 +0000 Subject: Enable secure XML processing --- src/main/java/org/zwobble/mammoth/internal/xml/parsing/SimpleSax.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/main') diff --git a/src/main/java/org/zwobble/mammoth/internal/xml/parsing/SimpleSax.java b/src/main/java/org/zwobble/mammoth/internal/xml/parsing/SimpleSax.java index 6a2950d..0f444ba 100644 --- a/src/main/java/org/zwobble/mammoth/internal/xml/parsing/SimpleSax.java +++ b/src/main/java/org/zwobble/mammoth/internal/xml/parsing/SimpleSax.java @@ -23,7 +23,7 @@ class SimpleSax { static void parseStream(InputStream input, SimpleSaxHandler handler) { parseInputSource(new InputSource(input), handler); } - + static void parseString(String value, SimpleSaxHandler handler) { parseInputSource(new InputSource(new StringReader(value)), handler); } @@ -34,7 +34,7 @@ class SimpleSax { try { parserFactory.setFeature("http://xml.org/sax/features/external-general-entities", false); parserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - parserFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false); + parserFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); SAXParser saxParser = parserFactory.newSAXParser(); XMLReader xmlReader = saxParser.getXMLReader(); xmlReader.setContentHandler(new DefaultHandler() { -- cgit v1.2.3