jmestwa-coder opened a new pull request, #4198: URL: https://github.com/apache/logging-log4j2/pull/4198
The Log4j 1.x `XmlConfiguration` reader resolves external XML entities. - the `DocumentBuilderFactory` is built with `setValidating(true)` and no entity restrictions - `Log4jEntityResolver` only handles `log4j.dtd` and returns `null` otherwise, so the parser falls back to fetching external entities - a legacy `log4j.xml` with a `SYSTEM` entity can read local files or reach network URLs - mirrors the `disableDtdProcessing` hardening already in `log4j-core`'s `XmlConfiguration` Test loads a config with an external entity and asserts it is not resolved. ## Checklist - [x] Base your changes on `2.x` branch - [x] `./mvnw verify` succeeds - [x] Non-trivial changes contain an entry file in the `src/changelog/.2.x.x` directory - [x] Tests are provided -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
