summaryrefslogtreecommitdiff
path: root/bkucommon/src/main
diff options
context:
space:
mode:
authorBianca Schnalzer <bianca.schnalzer@egiz.gv.at>2017-06-23 12:08:06 +0200
committerBianca Schnalzer <bianca.schnalzer@egiz.gv.at>2017-06-23 12:08:06 +0200
commit08ce5e1262d7b115e0350e445de97c78f9f4c597 (patch)
tree1dfb88505f1871e2816513676a03b58db2e00046 /bkucommon/src/main
parent2b395988ade78c58e6feaf55bd6ec129cf5f8e6f (diff)
parentbbe653345bbb5dad2ed2356df6f817dd7de26528 (diff)
downloadmocca-08ce5e1262d7b115e0350e445de97c78f9f4c597.tar.gz
mocca-08ce5e1262d7b115e0350e445de97c78f9f4c597.tar.bz2
mocca-08ce5e1262d7b115e0350e445de97c78f9f4c597.zip
Merge branch 'manuell_XXE_and_SSRF_validation' into 'master'
Manuell xxe and ssrf validation
Diffstat (limited to 'bkucommon/src/main')
-rw-r--r--bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java10
1 files changed, 9 insertions, 1 deletions
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java
index c838b24b..c3c2f14c 100644
--- a/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java
+++ b/bkucommon/src/main/java/at/gv/egiz/bku/slcommands/impl/xsect/Signature.java
@@ -73,6 +73,7 @@ import org.w3c.dom.ls.LSException;
import org.w3c.dom.ls.LSInput;
import org.w3c.dom.ls.LSOutput;
import org.w3c.dom.ls.LSParser;
+import org.w3c.dom.ls.LSParserFilter;
import org.w3c.dom.ls.LSResourceResolver;
import org.w3c.dom.ls.LSSerializer;
@@ -104,6 +105,8 @@ import at.gv.egiz.xades.QualifyingPropertiesFactory;
public class Signature {
public static final String XMLDSIG_PREFIX = "dsig";
+ public static final String SYSTEM_PROPERTY_ALLOW_DOCTYPES = "egiz.mocca.xades.xml.allow.doctype";
+
/**
* Logging facility.
*/
@@ -899,7 +902,12 @@ public class Signature {
LSResourceResolverAdapter resourceResolver = new LSResourceResolverAdapter(supplements);
domConfig.setParameter("resource-resolver", resourceResolver);
domConfig.setParameter("validate", Boolean.TRUE);
-
+
+ //Disallow DocTypes per default
+ String docTypeFlagString = System.getProperty(SYSTEM_PROPERTY_ALLOW_DOCTYPES, String.valueOf(Boolean.FALSE));
+ boolean docTypeFlag = Boolean.parseBoolean(docTypeFlagString.toLowerCase());
+ domConfig.setParameter("disallow-doctype", !docTypeFlag);
+
Document doc;
try {
doc = parser.parse(input);