You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ss...@apache.org on 2024/12/09 16:08:32 UTC
(sling-org-apache-sling-testing-osgi-mock) branch feature/SLING-12528-fix-xml-parser-2 created (now 20f504c)
This is an automated email from the ASF dual-hosted git repository.
sseifert pushed a change to branch feature/SLING-12528-fix-xml-parser-2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-testing-osgi-mock.git
at 20f504c SLING-12528 Fix "XML parsers should not be vulnerable to XXE attacks" there was another instances of DocumentBuilderFactory - reuse it
This branch includes the following new commits:
new 20f504c SLING-12528 Fix "XML parsers should not be vulnerable to XXE attacks" there was another instances of DocumentBuilderFactory - reuse it
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(sling-org-apache-sling-testing-osgi-mock) 01/01: SLING-12528 Fix "XML parsers should not be vulnerable to XXE attacks" there was another instances of DocumentBuilderFactory - reuse it
Posted by ss...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
sseifert pushed a commit to branch feature/SLING-12528-fix-xml-parser-2
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-testing-osgi-mock.git
commit 20f504c0d8a56656691d6ad4c86edcebdd9184fe
Author: Stefan Seifert <st...@users.noreply.github.com>
AuthorDate: Mon Dec 9 17:08:22 2024 +0100
SLING-12528 Fix "XML parsers should not be vulnerable to XXE attacks"
there was another instances of DocumentBuilderFactory - reuse it
---
.../org/apache/sling/testing/mock/osgi/OsgiMetadataUtil.java | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/core/src/main/java/org/apache/sling/testing/mock/osgi/OsgiMetadataUtil.java b/core/src/main/java/org/apache/sling/testing/mock/osgi/OsgiMetadataUtil.java
index 3a2570e..4d150af 100644
--- a/core/src/main/java/org/apache/sling/testing/mock/osgi/OsgiMetadataUtil.java
+++ b/core/src/main/java/org/apache/sling/testing/mock/osgi/OsgiMetadataUtil.java
@@ -76,6 +76,11 @@ final class OsgiMetadataUtil {
static {
DOCUMENT_BUILDER_FACTORY = DocumentBuilderFactory.newInstance();
+ try {
+ DOCUMENT_BUILDER_FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ } catch (ParserConfigurationException ex) {
+ throw new IllegalStateException("Error setting FEATURE_SECURE_PROCESSING.", ex);
+ }
DOCUMENT_BUILDER_FACTORY.setNamespaceAware(true);
}
@@ -220,9 +225,7 @@ final class OsgiMetadataUtil {
private static Document toXmlDocument(InputStream inputStream, String path) {
try {
- DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
- documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
+ DocumentBuilder documentBuilder = DOCUMENT_BUILDER_FACTORY.newDocumentBuilder();
return documentBuilder.parse(inputStream);
} catch (ParserConfigurationException ex) {
throw new RuntimeException("Unable to read classpath resource: " + path, ex);