[ https://issues.apache.org/jira/browse/WW-5252?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lukasz Lenart updated WW-5252: ------------------------------ Description: Reported by Sonar https://sonarcloud.io/project/issues?id=apache_struts&issues=AW_X5AiQ1FYS5oU8LTA8&open=AW_X5AiQ1FYS5oU8LTA8 {code:java} SAXParserFactory factory = SAXParserFactory.newInstance(); factory.setFeature("http://xml.org/sax/features/external-general-entities", false); factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); {code} https://sonarcloud.io/project/issues?id=apache_struts&issues=AXFGIxd5s40Y9j2_QZHd&open=AXFGIxd5s40Y9j2_QZHd {code:java} TransformerFactory factory = javax.xml.transform.TransformerFactory.newInstance(); // to be compliant, prohibit the use of all protocols by external entities: factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); {code} was: Reported by Sonar https://sonarcloud.io/project/issues?id=apache_struts&issues=AW_X5AiQ1FYS5oU8LTA8&open=AW_X5AiQ1FYS5oU8LTA8 {code:java} factory.setFeature("http://xml.org/sax/features/external-general-entities", false); factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); {code} > Completely disable external entities declarations in XML config > --------------------------------------------------------------- > > Key: WW-5252 > URL: https://issues.apache.org/jira/browse/WW-5252 > Project: Struts 2 > Issue Type: Improvement > Components: XML Configuration > Reporter: Lukasz Lenart > Priority: Major > Fix For: 6.1.0 > > > Reported by Sonar > https://sonarcloud.io/project/issues?id=apache_struts&issues=AW_X5AiQ1FYS5oU8LTA8&open=AW_X5AiQ1FYS5oU8LTA8 > {code:java} > SAXParserFactory factory = SAXParserFactory.newInstance(); > factory.setFeature("http://xml.org/sax/features/external-general-entities", > false); > factory.setFeature("http://xml.org/sax/features/external-parameter-entities", > false); > {code} > https://sonarcloud.io/project/issues?id=apache_struts&issues=AXFGIxd5s40Y9j2_QZHd&open=AXFGIxd5s40Y9j2_QZHd > {code:java} > TransformerFactory factory = > javax.xml.transform.TransformerFactory.newInstance(); > // to be compliant, prohibit the use of all protocols by external entities: > factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); > factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); > {code} -- This message was sent by Atlassian Jira (v8.20.10#820010)