You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jdo-commits@db.apache.org by ti...@apache.org on 2024/02/17 15:35:37 UTC
(db-jdo) 01/01: Disable external entity processing
This is an automated email from the ASF dual-hosted git repository.
tilmannz pushed a commit to branch jdo-839-XML-parser
in repository https://gitbox.apache.org/repos/asf/db-jdo.git
commit e8a67dbc325e559a3108cfce434e41c054485c6c
Author: Tilmann <zo...@gmx.de>
AuthorDate: Sat Feb 17 16:35:23 2024 +0100
Disable external entity processing
---
api/src/main/java/javax/jdo/JDOHelper.java | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/api/src/main/java/javax/jdo/JDOHelper.java b/api/src/main/java/javax/jdo/JDOHelper.java
index 54df4741..eee4e34b 100644
--- a/api/src/main/java/javax/jdo/JDOHelper.java
+++ b/api/src/main/java/javax/jdo/JDOHelper.java
@@ -367,6 +367,7 @@ public class JDOHelper implements Constants {
return IMPL_HELPER.nonBinaryCompatibleGet(pc, getVersion);
}
}
+
/**
* Tests whether the parameter instance is dirty.
*
@@ -1143,6 +1144,11 @@ public class JDOHelper implements Constants {
protected static DocumentBuilderFactory getDefaultDocumentBuilderFactory() {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+ try {
+ factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+ } catch (ParserConfigurationException e) {
+ throw new JDOFatalUserException(e.getMessage());
+ }
factory.setIgnoringComments(true);
factory.setNamespaceAware(true);
factory.setValidating(false);