summaryrefslogtreecommitdiff
path: root/utils/src/main/java/at
diff options
context:
space:
mode:
Diffstat (limited to 'utils/src/main/java/at')
-rw-r--r--utils/src/main/java/at/gv/egiz/slbinding/SLUnmarshaller.java5
1 files changed, 5 insertions, 0 deletions
diff --git a/utils/src/main/java/at/gv/egiz/slbinding/SLUnmarshaller.java b/utils/src/main/java/at/gv/egiz/slbinding/SLUnmarshaller.java
index 90e08401..70f5dce1 100644
--- a/utils/src/main/java/at/gv/egiz/slbinding/SLUnmarshaller.java
+++ b/utils/src/main/java/at/gv/egiz/slbinding/SLUnmarshaller.java
@@ -238,6 +238,11 @@ public Object unmarshal(StreamSource source) throws XMLStreamException, JAXBExce
ReportingValidationEventHandler validationEventHandler = new ReportingValidationEventHandler();
XMLInputFactory inputFactory = XMLInputFactory.newInstance();
+
+ //disallow DTD and external entities
+ inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+ inputFactory.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
+
XMLEventReader eventReader = inputFactory.createXMLEventReader(source.getReader());
RedirectEventFilter redirectEventFilter = new RedirectEventFilter();
XMLEventReader filteredReader = inputFactory.createFilteredReader(eventReader, redirectEventFilter);