[jira] [Commented] (WW-5252) Completely disable external entities declarations in XML config

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/WW-5252?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17627571#comment-17627571 ] 

ASF subversion and git services commented on WW-5252:
-----------------------------------------------------

Commit 79a84a8f0255e66344a88fef3aa2d1fa5001507d in struts's branch refs/heads/master from Lukasz Lenart
[ https://gitbox.apache.org/repos/asf?p=struts.git;h=79a84a8f0 ]

Merge pull request #628 from apache/WW-5252-external

[WW-5252] Disables parsing external entities

> Completely disable external entities declarations in XML config
> ---------------------------------------------------------------
>
>                 Key: WW-5252
>                 URL: https://issues.apache.org/jira/browse/WW-5252
>             Project: Struts 2
>          Issue Type: Improvement
>          Components: XML Configuration
>            Reporter: Lukasz Lenart
>            Priority: Major
>             Fix For: 6.1.0
>
>          Time Spent: 40m
>  Remaining Estimate: 0h
>
> Reported by Sonar
> https://sonarcloud.io/project/issues?id=apache_struts&issues=AW_X5AiQ1FYS5oU8LTA8&open=AW_X5AiQ1FYS5oU8LTA8
> {code:java}
> SAXParserFactory factory = SAXParserFactory.newInstance();
> factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
> factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
> {code}
> https://sonarcloud.io/project/issues?id=apache_struts&issues=AXFGIxd5s40Y9j2_QZHd&open=AXFGIxd5s40Y9j2_QZHd
> {code:java}
> TransformerFactory factory = javax.xml.transform.TransformerFactory.newInstance();
> // to be compliant, prohibit the use of all protocols by external entities:
> factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
> factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
> {code}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)