You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pdfbox.apache.org by ti...@apache.org on 2019/11/23 12:17:10 UTC
svn commit: r1870230 -
/pdfbox/branches/issue45/tools/src/main/java/org/apache/pdfbox/tools/imageio/MetaUtil.java
Author: tilman
Date: Sat Nov 23 12:17:10 2019
New Revision: 1870230
URL: http://svn.apache.org/viewvc?rev=1870230&view=rev
Log:
PDFBOX-4071: SonarQube fix: enable secure processing
Modified:
pdfbox/branches/issue45/tools/src/main/java/org/apache/pdfbox/tools/imageio/MetaUtil.java
Modified: pdfbox/branches/issue45/tools/src/main/java/org/apache/pdfbox/tools/imageio/MetaUtil.java
URL: http://svn.apache.org/viewvc/pdfbox/branches/issue45/tools/src/main/java/org/apache/pdfbox/tools/imageio/MetaUtil.java?rev=1870230&r1=1870229&r2=1870230&view=diff
==============================================================================
--- pdfbox/branches/issue45/tools/src/main/java/org/apache/pdfbox/tools/imageio/MetaUtil.java (original)
+++ pdfbox/branches/issue45/tools/src/main/java/org/apache/pdfbox/tools/imageio/MetaUtil.java Sat Nov 23 12:17:10 2019
@@ -19,6 +19,7 @@ package org.apache.pdfbox.tools.imageio;
import java.io.StringWriter;
import javax.imageio.metadata.IIOMetadata;
import javax.imageio.metadata.IIOMetadataNode;
+import javax.xml.XMLConstants;
import javax.xml.transform.OutputKeys;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerException;
@@ -59,7 +60,9 @@ public final class MetaUtil
{
StringWriter xmlStringWriter = new StringWriter();
StreamResult streamResult = new StreamResult(xmlStringWriter);
- Transformer transformer = TransformerFactory.newInstance().newTransformer();
+ TransformerFactory transformerFactory = TransformerFactory.newInstance();
+ transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ Transformer transformer = transformerFactory.newTransformer();
// see http://stackoverflow.com/a/1264872/535646
transformer.setOutputProperty(OutputKeys.INDENT, "yes");
transformer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount", "2");