reta commented on code in PR #407:
URL: https://github.com/apache/cxf-xjc-utils/pull/407#discussion_r4337142883
##########
cxf-xjc-plugin/src/main/java/org/apache/cxf/maven_plugin/XSDToJavaRunner.java:
##########
@@ -94,6 +94,36 @@ private static File getFile(String s, XJCErrorListener l)
throws Exception {
}
}
+ /**
+ * Parses an XML catalog with external DTD and schema access disabled, so
that a catalog
+ * cannot be used as an XXE vector (reading local files or making network
requests while it
+ * is parsed). A legitimate OASIS XML catalog needs neither, so this does
not restrict normal
+ * use. The restriction is applied only around the catalog parse and then
restored, so it does
+ * not affect how the schemas themselves are parsed.
+ */
+ static void parseCatalog(CatalogResolver catalogResolver, String
catalogPath) throws IOException {
+ String dtdKey = "javax.xml.accessExternalDTD";
+ String schemaKey = "javax.xml.accessExternalSchema";
+ String dtd = System.getProperty(dtdKey);
Review Comment:
@coheigea I am unsure this will work, it looks that system properties are
read only once (I suspect it is managed by `XMLSecurityPropertyManager`, could
be mistaken, but it really depends on initialization), do we have a choice to
pass it though features / factory props / etc instead?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
