diff options
| author | kstranacher <kstranacher@d688527b-c9ab-4aba-bd8d-4036d912da1d> | 2011-08-31 14:45:52 +0000 |
|---|---|---|
| committer | kstranacher <kstranacher@d688527b-c9ab-4aba-bd8d-4036d912da1d> | 2011-08-31 14:45:52 +0000 |
| commit | 9b0b76abd6bdd88383e465117086d65268c25562 (patch) | |
| tree | 2f53d26ff63352dbe0dcfe077cb2add2e2c375d6 /common | |
| parent | 09cc9a356b945822ba5d8e939c30ca104967d278 (diff) | |
| download | moa-id-spss-9b0b76abd6bdd88383e465117086d65268c25562.tar.gz moa-id-spss-9b0b76abd6bdd88383e465117086d65268c25562.tar.bz2 moa-id-spss-9b0b76abd6bdd88383e465117086d65268c25562.zip | |
Update Axis-Lib von 1.0 auf 1.1 aufgrund XXE (Xml eXternal Entity) Injection
git-svn-id: https://joinup.ec.europa.eu/svn/moa-idspss/trunk@1214 d688527b-c9ab-4aba-bd8d-4036d912da1d
Diffstat (limited to 'common')
| -rw-r--r-- | common/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/common/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java b/common/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java index 936423724..5fa31336b 100644 --- a/common/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java +++ b/common/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java @@ -200,6 +200,13 @@ public class DOMUtils { DOMParser parser; +// class MyEntityResolver implements EntityResolver { +// +// public InputSource resolveEntity(String publicId, String systemId) +// throws SAXException, IOException { +// return new InputSource(new ByteArrayInputStream(new byte[0])); +// } +// } //if Debug is enabled make a copy of inputStream to enable debug output in case of SAXException @@ -218,7 +225,7 @@ public class DOMUtils { } else { parser = new DOMParser(); } - + // set parser features and properties try { parser.setFeature(NAMESPACES_FEATURE, true); @@ -227,6 +234,8 @@ public class DOMUtils { parser.setFeature(NORMALIZED_VALUE_FEATURE, false); parser.setFeature(INCLUDE_IGNORABLE_WHITESPACE_FEATURE, true); parser.setFeature(CREATE_ENTITY_REF_NODES_FEATURE, false); + //parser.setFeature("http://xml.org/sax/features/external-general-entities", false); + //parser.setFeature("http://xml.org/sax/features/external-parameter-entities", false); if (validating) { if (externalSchemaLocations != null) { @@ -495,6 +504,7 @@ public class DOMUtils { parser.setFeature(NAMESPACES_FEATURE, true); parser.setFeature(VALIDATION_FEATURE, true); parser.setFeature(SCHEMA_VALIDATION_FEATURE, true); + if (externalSchemaLocations != null) { parser.setProperty( EXTERNAL_SCHEMA_LOCATION_PROPERTY, |