[ https://issues.apache.org/jira/browse/WW-5252?focusedWorklogId=820945&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-820945 ]
ASF GitHub Bot logged work on WW-5252: -------------------------------------- Author: ASF GitHub Bot Created on: 27/Oct/22 11:35 Start Date: 27/Oct/22 11:35 Worklog Time Spent: 10m Work Description: lukaszlenart opened a new pull request, #628: URL: https://github.com/apache/struts/pull/628 Fixes [WW-5252](https://issues.apache.org/jira/browse/WW-5252) Issue Time Tracking ------------------- Worklog Id: (was: 820945) Remaining Estimate: 0h Time Spent: 10m > Completely disable external entities declarations in XML config > --------------------------------------------------------------- > > Key: WW-5252 > URL: https://issues.apache.org/jira/browse/WW-5252 > Project: Struts 2 > Issue Type: Improvement > Components: XML Configuration > Reporter: Lukasz Lenart > Priority: Major > Fix For: 6.1.0 > > Time Spent: 10m > Remaining Estimate: 0h > > Reported by Sonar > https://sonarcloud.io/project/issues?id=apache_struts&issues=AW_X5AiQ1FYS5oU8LTA8&open=AW_X5AiQ1FYS5oU8LTA8 > {code:java} > SAXParserFactory factory = SAXParserFactory.newInstance(); > factory.setFeature("http://xml.org/sax/features/external-general-entities", > false); > factory.setFeature("http://xml.org/sax/features/external-parameter-entities", > false); > {code} > https://sonarcloud.io/project/issues?id=apache_struts&issues=AXFGIxd5s40Y9j2_QZHd&open=AXFGIxd5s40Y9j2_QZHd > {code:java} > TransformerFactory factory = > javax.xml.transform.TransformerFactory.newInstance(); > // to be compliant, prohibit the use of all protocols by external entities: > factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); > factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); > {code} -- This message was sent by Atlassian Jira (v8.20.10#820010)