You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2025/03/28 10:20:58 UTC
(sling-org-apache-sling-junit-core) branch issue/SLING-12722 created (now 48a2323)
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a change to branch issue/SLING-12722
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-junit-core.git
at 48a2323 SLING-12722 - Enable secure XML processing in XmlRenderer
This branch includes the following new commits:
new 48a2323 SLING-12722 - Enable secure XML processing in XmlRenderer
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(sling-org-apache-sling-junit-core) 01/01: SLING-12722 - Enable secure XML processing in XmlRenderer
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch issue/SLING-12722
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-junit-core.git
commit 48a23235bbf249018a791b61ae8512f8925d2395
Author: Robert Munteanu <ro...@apache.org>
AuthorDate: Fri Mar 28 11:20:29 2025 +0100
SLING-12722 - Enable secure XML processing in XmlRenderer
Follow-up fixes
---
src/main/java/org/apache/sling/junit/impl/servlet/XmlRenderer.java | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/main/java/org/apache/sling/junit/impl/servlet/XmlRenderer.java b/src/main/java/org/apache/sling/junit/impl/servlet/XmlRenderer.java
index 2297408..d8dd064 100644
--- a/src/main/java/org/apache/sling/junit/impl/servlet/XmlRenderer.java
+++ b/src/main/java/org/apache/sling/junit/impl/servlet/XmlRenderer.java
@@ -282,8 +282,8 @@ public class XmlRenderer extends RunListener implements Renderer, RendererFactor
try {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
factory.setExpandEntityReferences(false);
return factory.newDocumentBuilder();
} catch (Exception exc) {
@@ -300,6 +300,8 @@ public class XmlRenderer extends RunListener implements Renderer, RendererFactor
try {
TransformerFactory tf = TransformerFactory.newInstance();
tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
Transformer trans = tf.newTransformer();
StringWriter sw = new StringWriter();
trans.transform(new DOMSource(element), new StreamResult(sw));