garydgregory commented on code in PR #108:
URL: https://github.com/apache/commons-jelly/pull/108#discussion_r3945178193
##########
core/src/main/java/org/apache/commons/jelly/parser/XMLParser.java:
##########
@@ -810,12 +811,17 @@ public SAXParser getParser() {
// Create and return a new parser
synchronized (this) {
try {
- if (factory == null) {
- factory = SAXParserFactory.newInstance();
+ SAXParserFactory parserFactory = factory;
+ if (parserFactory == null) {
+ // The secure factory's resolver floor would ignore
external entities, so the
+ // documented opt-in keeps using a plain factory; do not
cache the per-instance choice.
+ parserFactory = allowDtdToCallExternalEntities
Review Comment:
https://github.com/apache/commons-jelly/commit/4c8213b55e5265d58697122aabf467d049f73281
looks good.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
