https://bz.apache.org/bugzilla/show_bug.cgi?id=63899
--- Comment #6 from PJ Fanning <[email protected]> --- If you want to prevent the DTD being read at all, try this: final String FEATURE_LOAD_DTD_GRAMMAR = "http://apache.org/xml/features/nonvalidating/load-dtd-grammar";; final String FEATURE_LOAD_EXTERNAL_DTD = "http://apache.org/xml/features/nonvalidating/load-external-dtd";; final String FEATURE_DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";; SAXParserFactory saxFactory = SAXParserFactory.newInstance(); saxFactory.setValidating(false); saxFactory.setNamespaceAware(true); saxFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); saxFactory.setFeature(FEATURE_LOAD_DTD_GRAMMAR, false); saxFactory.setFeature(FEATURE_LOAD_EXTERNAL_DTD, false); saxFactory.setFeature(FEATURE_DISALLOW_DOCTYPE_DECL, true); XMLReader xmlReader = saxFactory.newSAXParser().getXMLReader(); org.apache.poi.ooxml.POIXMLTypeLoader.DEFAULT_XML_OPTIONS.setLoadUseXMLReader(xmlReader); -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
