[ https://issues.apache.org/jira/browse/WW-5252?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17626218#comment-17626218 ]
ASF subversion and git services commented on WW-5252: ----------------------------------------------------- Commit 8d2d996056db234701cf79174e2ed3e70043f8fa in struts's branch refs/heads/WW-5252-external from Lukasz Lenart [ https://gitbox.apache.org/repos/asf?p=struts.git;h=8d2d99605 ] WW-5252 Reuses factory method > Completely disable external entities declarations in XML config > --------------------------------------------------------------- > > Key: WW-5252 > URL: https://issues.apache.org/jira/browse/WW-5252 > Project: Struts 2 > Issue Type: Improvement > Components: XML Configuration > Reporter: Lukasz Lenart > Priority: Major > Fix For: 6.1.0 > > Time Spent: 20m > Remaining Estimate: 0h > > Reported by Sonar > https://sonarcloud.io/project/issues?id=apache_struts&issues=AW_X5AiQ1FYS5oU8LTA8&open=AW_X5AiQ1FYS5oU8LTA8 > {code:java} > SAXParserFactory factory = SAXParserFactory.newInstance(); > factory.setFeature("http://xml.org/sax/features/external-general-entities", > false); > factory.setFeature("http://xml.org/sax/features/external-parameter-entities", > false); > {code} > https://sonarcloud.io/project/issues?id=apache_struts&issues=AXFGIxd5s40Y9j2_QZHd&open=AXFGIxd5s40Y9j2_QZHd > {code:java} > TransformerFactory factory = > javax.xml.transform.TransformerFactory.newInstance(); > // to be compliant, prohibit the use of all protocols by external entities: > factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); > factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); > {code} -- This message was sent by Atlassian Jira (v8.20.10#820010)