You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by su...@apache.org on 2022/01/05 18:02:01 UTC
[hadoop] 02/02: HDFS-16410. Insecure Xml parsing in OfflineEditsXmlLoader (#3854)
This is an automated email from the ASF dual-hosted git repository.
sunchao pushed a commit to branch branch-3.3.2
in repository https://gitbox.apache.org/repos/asf/hadoop.git
commit 6ea9906a8b7158f59a0afab9db1dfeb1e77c3fe0
Author: Ashutosh Gupta <as...@st.niituniversity.in>
AuthorDate: Wed Jan 5 21:21:14 2022 +0530
HDFS-16410. Insecure Xml parsing in OfflineEditsXmlLoader (#3854)
Contributed by Ashutosh Gupta
---
.../hadoop/hdfs/tools/offlineEditsViewer/OfflineEditsXmlLoader.java | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/tools/offlineEditsViewer/OfflineEditsXmlLoader.java b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/tools/offlineEditsViewer/OfflineEditsXmlLoader.java
index 7238c58..fc5f30e 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/tools/offlineEditsViewer/OfflineEditsXmlLoader.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/tools/offlineEditsViewer/OfflineEditsXmlLoader.java
@@ -86,6 +86,10 @@ class OfflineEditsXmlLoader
public void loadEdits() throws IOException {
try {
XMLReader xr = XMLReaderFactory.createXMLReader();
+ xr.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+ xr.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+ xr.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ xr.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
xr.setContentHandler(this);
xr.setErrorHandler(this);
xr.setDTDHandler(null);
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-commits-help@hadoop.apache.org