(tika) branch branch_3x updated: Improve configuration of xmlinputfactory (#2294)

[tallison]

This is an automated email from the ASF dual-hosted git repository.

tallison pushed a commit to branch branch_3x
in repository https://gitbox.apache.org/repos/asf/tika.git


The following commit(s) were added to refs/heads/branch_3x by this push:
     new 94acef285 Improve configuration of xmlinputfactory (#2294)
94acef285 is described below

commit 94acef2854eed07f0ded357c13a659409495ca49
Author: Tim Allison <talli...@apache.org>
AuthorDate: Mon Aug 4 11:59:26 2025 -0400

    Improve configuration of xmlinputfactory (#2294)
    
    (cherry picked from commit bfee6d5569fe9197c4ea947a96e212825184ca33)
---
 tika-core/src/main/java/org/apache/tika/utils/XMLReaderUtils.java | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tika-core/src/main/java/org/apache/tika/utils/XMLReaderUtils.java 
b/tika-core/src/main/java/org/apache/tika/utils/XMLReaderUtils.java
index 99ba32cc2..6ac89ee4e 100644
--- a/tika-core/src/main/java/org/apache/tika/utils/XMLReaderUtils.java
+++ b/tika-core/src/main/java/org/apache/tika/utils/XMLReaderUtils.java
@@ -308,6 +308,8 @@ public class XMLReaderUtils implements Serializable {
 
         tryToSetStaxProperty(factory, XMLInputFactory.IS_NAMESPACE_AWARE, 
true);
         tryToSetStaxProperty(factory, XMLInputFactory.IS_VALIDATING, false);
+        tryToSetStaxProperty(factory, XMLInputFactory.SUPPORT_DTD, false);
+        tryToSetStaxProperty(factory, 
XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
 
         factory.setXMLResolver(IGNORING_STAX_ENTITY_RESOLVER);
         trySetStaxSecurityManager(factory);