You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@struts.apache.org by "Lukasz Lenart (Jira)" <ji...@apache.org> on 2022/10/25 11:25:00 UTC
[jira] [Updated] (WW-5252) Completely disable external entities declarations in XML config
[ https://issues.apache.org/jira/browse/WW-5252?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lukasz Lenart updated WW-5252:
------------------------------
Description:
Reported by Sonar
https://sonarcloud.io/project/issues?id=apache_struts&issues=AW_X5AiQ1FYS5oU8LTA8&open=AW_X5AiQ1FYS5oU8LTA8
{code:java}
SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
{code}
https://sonarcloud.io/project/issues?id=apache_struts&issues=AXFGIxd5s40Y9j2_QZHd&open=AXFGIxd5s40Y9j2_QZHd
{code:java}
TransformerFactory factory = javax.xml.transform.TransformerFactory.newInstance();
// to be compliant, prohibit the use of all protocols by external entities:
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
{code}
was:
Reported by Sonar
https://sonarcloud.io/project/issues?id=apache_struts&issues=AW_X5AiQ1FYS5oU8LTA8&open=AW_X5AiQ1FYS5oU8LTA8
{code:java}
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
{code}
> Completely disable external entities declarations in XML config
> ---------------------------------------------------------------
>
> Key: WW-5252
> URL: https://issues.apache.org/jira/browse/WW-5252
> Project: Struts 2
> Issue Type: Improvement
> Components: XML Configuration
> Reporter: Lukasz Lenart
> Priority: Major
> Fix For: 6.1.0
>
>
> Reported by Sonar
> https://sonarcloud.io/project/issues?id=apache_struts&issues=AW_X5AiQ1FYS5oU8LTA8&open=AW_X5AiQ1FYS5oU8LTA8
> {code:java}
> SAXParserFactory factory = SAXParserFactory.newInstance();
> factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
> factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
> {code}
> https://sonarcloud.io/project/issues?id=apache_struts&issues=AXFGIxd5s40Y9j2_QZHd&open=AXFGIxd5s40Y9j2_QZHd
> {code:java}
> TransformerFactory factory = javax.xml.transform.TransformerFactory.newInstance();
> // to be compliant, prohibit the use of all protocols by external entities:
> factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
> factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)