1 files changed, 21 insertions, 9 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
index f97d646b6..47ea91753 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
@@ -46,20 +46,20 @@
 

 package at.gv.egovernment.moa.id.util;

 

+import java.io.ByteArrayInputStream;

 import java.io.IOException;

-import java.io.StringReader;

 import java.net.MalformedURLException;

 import java.net.URL;

+import java.util.Collections;

+import java.util.HashMap;

 import java.util.List;

+import java.util.Map;

 import java.util.regex.Matcher;

 import java.util.regex.Pattern;

 

 import javax.servlet.http.HttpServletRequest;

-import javax.xml.parsers.DocumentBuilder;

-import javax.xml.parsers.DocumentBuilderFactory;

 import javax.xml.parsers.ParserConfigurationException;

 

-import org.xml.sax.InputSource;

 import org.xml.sax.SAXException;

 

 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

@@ -68,12 +68,22 @@ import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
 import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;

 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;

 import at.gv.egovernment.moa.logging.Logger;

+import at.gv.egovernment.moa.util.DOMUtils;

 import at.gv.egovernment.moa.util.MiscUtil;

 import at.gv.egovernment.moa.util.StringUtils;

 

 

 public class ParamValidatorUtils extends MOAIDAuthConstants{

    

+	  private static final Map<String, Object> parserFeatures =

+			  Collections.unmodifiableMap(new HashMap<String, Object>() {

+					private static final long serialVersionUID = 1L;

+					{	

+						put(DOMUtils.DISALLOW_DOCTYPE_FEATURE, true);

+						

+					}

+			  });

+	

    /**

     * Checks if the given target is valid

     * @param target HTTP parameter from request

@@ -482,11 +492,13 @@ public class ParamValidatorUtils extends MOAIDAuthConstants{
 		   return false;

 	   

 	   Logger.debug("Ueberpruefe Parameter XMLDocument");

-	   try {   

-		   DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

-		   DocumentBuilder builder = factory.newDocumentBuilder();

-		   InputSource is = new InputSource(new StringReader(document));

-		   builder.parse(is);

+	   try {

+		   DOMUtils.parseXmlValidating(new ByteArrayInputStream(document.getBytes()), parserFeatures);

+		   

+//		   DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

+//		   DocumentBuilder builder = factory.newDocumentBuilder();

+//		   InputSource is = new InputSource(new StringReader(document));

+//		   builder.parse(is);

 		   

 		   Logger.debug("Parameter XMLDocument erfolgreich ueberprueft");

 		   return true;