You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@struts.apache.org by lu...@apache.org on 2023/07/16 07:18:45 UTC
[struts] 02/02: WW-5233 Disables XML external entity parsing
This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch WW-5233-tiles
in repository https://gitbox.apache.org/repos/asf/struts.git
commit 93519c9ff85ad98aad442f52f521b59def9f0db0
Author: Lukasz Lenart <lu...@apache.org>
AuthorDate: Fri Jul 14 08:15:19 2023 +0200
WW-5233 Disables XML external entity parsing
---
.../definition/digester/DigesterDefinitionsReader.java | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/plugins/tiles/src/main/java/org/apache/tiles/core/definition/digester/DigesterDefinitionsReader.java b/plugins/tiles/src/main/java/org/apache/tiles/core/definition/digester/DigesterDefinitionsReader.java
index 4d756bbb2..ccbed0a81 100644
--- a/plugins/tiles/src/main/java/org/apache/tiles/core/definition/digester/DigesterDefinitionsReader.java
+++ b/plugins/tiles/src/main/java/org/apache/tiles/core/definition/digester/DigesterDefinitionsReader.java
@@ -21,6 +21,7 @@ package org.apache.tiles.core.definition.digester;
import org.apache.commons.digester.Digester;
import org.apache.commons.digester.Rule;
+import org.apache.struts2.StrutsException;
import org.apache.tiles.api.Attribute;
import org.apache.tiles.api.Definition;
import org.apache.tiles.api.Expression;
@@ -30,8 +31,11 @@ import org.apache.tiles.core.definition.DefinitionsReader;
import org.xml.sax.Attributes;
import org.xml.sax.ErrorHandler;
import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
import org.xml.sax.SAXParseException;
+import javax.xml.parsers.ParserConfigurationException;
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;
@@ -256,6 +260,17 @@ public class DigesterDefinitionsReader implements DefinitionsReader {
digester.setNamespaceAware(true);
digester.setUseContextClassLoader(true);
digester.setErrorHandler(new ThrowingErrorHandler());
+ try {
+ //OWASP
+ //https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
+ digester.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ digester.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ // Disable external DTDs as well
+ digester.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+ digester.setXIncludeAware(false);
+ } catch (ParserConfigurationException | SAXNotRecognizedException | SAXNotSupportedException e) {
+ throw new StrutsException("Unable to disable external XML entity parsing", e);
+ }
// Register our local copy of the DTDs that we can find
String[] registrations = getRegistrations();