0ct0pu5/fess
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #2419 from codelibs/ds_load-external-dtd

Browse source 
Set load-external-dtd as false by default
This commit is contained in:
Shinsuke Sugaya 2020-03-03 20:49:22 +09:00 • committed by GitHub
commit ee10c1b2bc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/main/java/org/codelibs/fess/ds/DataStoreFactory.java
View file

@ -35,6 +35,7 @@ import javax.xml.parsers.DocumentBuilderFactory;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.xerces.impl.Constants;
import org.codelibs.core.lang.StringUtil;
import org.codelibs.fess.helper.PluginHelper;
import org.codelibs.fess.util.ResourceUtil;
@ -87,6 +88,7 @@ public class DataStoreFactory {
try (InputStream is = Files.newInputStream(xmlPath)) {
final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature(Constants.XERCES_FEATURE_PREFIX + Constants.LOAD_EXTERNAL_DTD_FEATURE, false);
final DocumentBuilder builder = factory.newDocumentBuilder();
final Document doc = builder.parse(is);