-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 All,
I'm trying to build an XML file that includes several smaller XML files using XXE, like this: bar.xml: <?xml version="1.0"?> <!DOCTYPE config [ <!ENTITY foo SYSTEM "foo.xml"> ]> <config> &foo; </config> The files "foo.xml" and "bar.xml" are in the same directory. This works great when the CWD of the process is the same as foo.xml and bar.xml, but when I try to say "hey program, parse /a/b/c/bar.xml", I get FileNotFoundException for CWD/foo.xml. We often recommend that people use XXE for "password-less" server.xml files. Is everyone using absolute filenames for that? Or is there some kind of option that I need to set on Xerces (being used internally by the JVM -- the com.sun.org.apache.xerces flavor) or Digester (I'm using commons-digester to read the XML) to enable relative entities? I've been searching the web for references to things like this, and it appears that various versions of Xerces (including the C version) had a bug where relative paths weren't working properly (the XML spec says that relative paths such as the above should be relative to the document that defined them -- that is: foo.xml should be expected in the same location as bar.xml in my example above). Do I just have a buggy version of Xerces? Thanks, - -chris -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJXcp1vAAoJEBzwKT+lPKRYfXcP/2SdmSpa7dLwBed7xv97BHLl Lq8JSJSVkVvZZjTF6gHvn8xVfGm+6KA1LQ6KRsSoke8ZKf54waUKclYcd04/Jkb5 N9na6UknDTCrhwPsY1xOyRZQ5jq62MeyxtJE+8EHitCwIaAqyaOaxsG1djPGnNpP a68N4WQ3qyumDuoSC9Slx5jLPi/i4XciSGCx/LRC0zaY3ABmU+boOjBK+41Ambjz 0h9kWGqSm0/QRO8wETSoWzHLtrqckRXbkvHXnydaiCcmvE1ELmAd/364+TR2ZCeu jZVO9uVSzpZkV8IQTa6Zic57avFfFdKmIRHiItDhW9Rm9l6SJgWZJmWV1/YDXcRB IEocNgSz1Ad4gU1yVsv8gHH7LTTDggmgAjwlzdjCPkKB1dGCjLW2uYmJ7qNh0hsQ GrjCG0/wisvhZh7m5K0zroG3+oYnnD+KmrEs5wUr9JDUC2TnV4a9LXozDbHdctNs ojz+bFeBeC+hv6L8ICDTUk+fnptD2PAzPDDf59MukS3X2LEDNuv9y+N71wLyI20w ecfgI6Eelgwe4Rf9dSBUNz84rArS7gzP9TDpOFV7jqP6uz7glDtIw5Wp+rRJ6xRR e9taycc9HzQg+6CnzwbNr4XCLemq+b2/agRCxLX42NiMBxEwBGGXSyiF1tsTi9Be EgBW4TOvmiba15v5bsnx =vS/0 -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
