You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@xmlgraphics.apache.org by ss...@apache.org on 2026/02/26 16:06:42 UTC
(xmlgraphics-fop) branch main updated: FOP-3298: Disallow DTD from SVG font
This is an automated email from the ASF dual-hosted git repository.
ssteiner pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/xmlgraphics-fop.git
The following commit(s) were added to refs/heads/main by this push:
new 207ed8ec0 FOP-3298: Disallow DTD from SVG font
207ed8ec0 is described below
commit 207ed8ec03cd506f294e31b56048196ef3396ba2
Author: Simon Steiner <ss...@apache.org>
AuthorDate: Thu Feb 26 16:05:50 2026 +0000
FOP-3298: Disallow DTD from SVG font
---
.../src/main/java/org/apache/fop/fonts/truetype/SVGGlyphData.java | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fop-core/src/main/java/org/apache/fop/fonts/truetype/SVGGlyphData.java b/fop-core/src/main/java/org/apache/fop/fonts/truetype/SVGGlyphData.java
index 9bc248331..5105c6155 100644
--- a/fop-core/src/main/java/org/apache/fop/fonts/truetype/SVGGlyphData.java
+++ b/fop-core/src/main/java/org/apache/fop/fonts/truetype/SVGGlyphData.java
@@ -64,7 +64,11 @@ public class SVGGlyphData {
private String updateTransform(String svg, int height)
throws IOException, ParserConfigurationException, SAXException, TransformerException {
- DocumentBuilder documentBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+ DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+ dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+ dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ DocumentBuilder documentBuilder = dbf.newDocumentBuilder();
InputSource inputSource = new InputSource();
inputSource.setCharacterStream(new StringReader(svg));
Document doc = documentBuilder.parse(inputSource);
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@xmlgraphics.apache.org
For additional commands, e-mail: commits-help@xmlgraphics.apache.org