diff options
| -rw-r--r-- | utils/src/main/java/at/gv/egiz/slbinding/SLUnmarshaller.java | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/utils/src/main/java/at/gv/egiz/slbinding/SLUnmarshaller.java b/utils/src/main/java/at/gv/egiz/slbinding/SLUnmarshaller.java index 90e08401..70f5dce1 100644 --- a/utils/src/main/java/at/gv/egiz/slbinding/SLUnmarshaller.java +++ b/utils/src/main/java/at/gv/egiz/slbinding/SLUnmarshaller.java @@ -238,6 +238,11 @@ public Object unmarshal(StreamSource source) throws XMLStreamException, JAXBExce ReportingValidationEventHandler validationEventHandler = new ReportingValidationEventHandler(); XMLInputFactory inputFactory = XMLInputFactory.newInstance(); + + //disallow DTD and external entities + inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); + inputFactory.setProperty("javax.xml.stream.isSupportingExternalEntities", false); + XMLEventReader eventReader = inputFactory.createXMLEventReader(source.getReader()); RedirectEventFilter redirectEventFilter = new RedirectEventFilter(); XMLEventReader filteredReader = inputFactory.createFilteredReader(eventReader, redirectEventFilter); |