This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/ws-neethi.git
commit 721d1ed0a6d44dc55e8c9977af5c4e0a1023ba08 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Apr 21 12:27:15 2026 +0100 Missing XML hardening step --- src/main/java/org/apache/neethi/PolicyBuilder.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/main/java/org/apache/neethi/PolicyBuilder.java b/src/main/java/org/apache/neethi/PolicyBuilder.java index ab82358..79ee02f 100644 --- a/src/main/java/org/apache/neethi/PolicyBuilder.java +++ b/src/main/java/org/apache/neethi/PolicyBuilder.java @@ -136,7 +136,10 @@ public class PolicyBuilder { */ public PolicyReference getPolicyReference(InputStream inputStream) { try { - XMLStreamReader reader = XMLInputFactory.newInstance().createXMLStreamReader(inputStream); + XMLInputFactory xif = XMLInputFactory.newInstance(); + xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); + xif.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE); + XMLStreamReader reader = xif.createXMLStreamReader(inputStream); return getPolicyReference(reader); } catch (RuntimeException ex) { throw ex;
