You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ss...@apache.org on 2024/12/09 16:08:33 UTC
(sling-org-apache-sling-testing-osgi-mock) 01/01: SLING-12528 Fix "XML parsers should not be vulnerable to XXE attacks" there was another instances of DocumentBuilderFactory - reuse it
This is an automated email from the ASF dual-hosted git repository.
sseifert pushed a commit to branch feature/SLING-12528-fix-xml-parser-2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-testing-osgi-mock.git
commit 20f504c0d8a56656691d6ad4c86edcebdd9184fe
Author: Stefan Seifert <st...@users.noreply.github.com>
AuthorDate: Mon Dec 9 17:08:22 2024 +0100
SLING-12528 Fix "XML parsers should not be vulnerable to XXE attacks"
there was another instances of DocumentBuilderFactory - reuse it
---
.../org/apache/sling/testing/mock/osgi/OsgiMetadataUtil.java | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/core/src/main/java/org/apache/sling/testing/mock/osgi/OsgiMetadataUtil.java b/core/src/main/java/org/apache/sling/testing/mock/osgi/OsgiMetadataUtil.java
index 3a2570e..4d150af 100644
--- a/core/src/main/java/org/apache/sling/testing/mock/osgi/OsgiMetadataUtil.java
+++ b/core/src/main/java/org/apache/sling/testing/mock/osgi/OsgiMetadataUtil.java
@@ -76,6 +76,11 @@ final class OsgiMetadataUtil {
static {
DOCUMENT_BUILDER_FACTORY = DocumentBuilderFactory.newInstance();
+ try {
+ DOCUMENT_BUILDER_FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ } catch (ParserConfigurationException ex) {
+ throw new IllegalStateException("Error setting FEATURE_SECURE_PROCESSING.", ex);
+ }
DOCUMENT_BUILDER_FACTORY.setNamespaceAware(true);
}
@@ -220,9 +225,7 @@ final class OsgiMetadataUtil {
private static Document toXmlDocument(InputStream inputStream, String path) {
try {
- DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
- documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
+ DocumentBuilder documentBuilder = DOCUMENT_BUILDER_FACTORY.newDocumentBuilder();
return documentBuilder.parse(inputStream);
} catch (ParserConfigurationException ex) {
throw new RuntimeException("Unable to read classpath resource: " + path, ex);