ppkarwasz commented on code in PR #108:
URL: https://github.com/apache/commons-jelly/pull/108#discussion_r3945122238
##########
core/src/main/java/org/apache/commons/jelly/parser/XMLParser.java:
##########
@@ -810,12 +811,17 @@ public SAXParser getParser() {
// Create and return a new parser
synchronized (this) {
try {
- if (factory == null) {
- factory = SAXParserFactory.newInstance();
+ SAXParserFactory parserFactory = factory;
+ if (parserFactory == null) {
+ // The secure factory's resolver floor would ignore
external entities, so the
+ // documented opt-in keeps using a plain factory; do not
cache the per-instance choice.
+ parserFactory = allowDtdToCallExternalEntities
Review Comment:
I guess the agent didn't find the way to allow DTDs **without** using an
insecure factory.
As I mentioned in the description: I haven't actually looked at the code of
these PRs. I'll remove the “Draft” status after I do.
I corrected this particular problem in
https://github.com/apache/commons-jelly/pull/108/commits/4c8213b55e5265d58697122aabf467d049f73281.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
