You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by ja...@apache.org on 2026/04/20 16:30:43 UTC
(ofbiz-framework) 03/04: Fixed: Enhance parsing security by disabling external entity resolution
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 5039f72c9f0374b190c94fba69b2883a4805b0b9
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Mon Apr 20 16:48:41 2026 +0200
Fixed: Enhance parsing security by disabling external entity resolution
---
.../main/java/org/apache/ofbiz/base/util/string/UelFunctions.java | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java
index 33730cfedb..9c9a8b1804 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java
@@ -368,6 +368,11 @@ public class UelFunctions {
URL url = FlexibleLocation.resolveLocation(str);
if (url != null) {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+ factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+ factory.setXIncludeAware(false);
+ factory.setExpandEntityReferences(false);
DocumentBuilder builder = factory.newDocumentBuilder();
document = builder.parse(url.openStream());
document.getDocumentElement().normalize();