(db-jdo) branch main updated: Disable external entity processing (#91)

[ti...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

tilmannz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/db-jdo.git


The following commit(s) were added to refs/heads/main by this push:
     new bfe71cba Disable external entity processing (#91)
bfe71cba is described below

commit bfe71cba94f0faf278454870f1d5c9bf20d2e342
Author: Tilmann <zo...@gmx.de>
AuthorDate: Tue Feb 20 20:23:52 2024 +0100

    Disable external entity processing (#91)
---
 api/src/main/java/javax/jdo/JDOHelper.java | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/api/src/main/java/javax/jdo/JDOHelper.java b/api/src/main/java/javax/jdo/JDOHelper.java
index 54df4741..eee4e34b 100644
--- a/api/src/main/java/javax/jdo/JDOHelper.java
+++ b/api/src/main/java/javax/jdo/JDOHelper.java
@@ -367,6 +367,7 @@ public class JDOHelper implements Constants {
       return IMPL_HELPER.nonBinaryCompatibleGet(pc, getVersion);
     }
   }
+
   /**
    * Tests whether the parameter instance is dirty.
    *
@@ -1143,6 +1144,11 @@ public class JDOHelper implements Constants {
 
   protected static DocumentBuilderFactory getDefaultDocumentBuilderFactory() {
     DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+    try {
+      factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+    } catch (ParserConfigurationException e) {
+      throw new JDOFatalUserException(e.getMessage());
+    }
     factory.setIgnoringComments(true);
     factory.setNamespaceAware(true);
     factory.setValidating(false);