Nemcio/SCM-Manager
1
0
Fork 0
mirror of https://github.com/scm-manager/scm-manager.git synced 2025-11-01 19:15:52 +01:00
Code Issues Packages Projects Releases Activity

disable access of external xml dtd and schema

Browse Source
This commit is contained in:
Sebastian Sdorra
2020-03-12 12:08:32 +01:00
parent e8188822fd
commit bfe856a1cd
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
scm-annotation-processor/src/main/java/sonia/scm/annotation/ScmAnnotationProcessor.java
View File

@@ -210,7 +210,8 @@ public final class ScmAnnotationProcessor extends AbstractProcessor {
private DocumentBuilder createDocumentBuilder() throws ParserConfigurationException {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
return factory.newDocumentBuilder();
}
@@ -327,13 +328,10 @@ public final class ScmAnnotationProcessor extends AbstractProcessor {
private void writeDocument(Document doc, File file) {
try {
file.getParentFile().mkdirs();
Transformer transformer = createTransformer();
transformer.setOutputProperty(OutputKeys.INDENT, PROPERTY_VALUE);
transformer.transform(new DOMSource(doc), new StreamResult(file));
} catch (IllegalArgumentException | TransformerException ex) {
printException("could not write document", ex);
@@ -342,10 +340,14 @@ public final class ScmAnnotationProcessor extends AbstractProcessor {
private Transformer createTransformer() throws TransformerConfigurationException {
TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
return factory.newTransformer();
}
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
Transformer transformer = factory.newTransformer();
transformer.setOutputProperty(OutputKeys.INDENT, PROPERTY_VALUE);
return transformer;
}
private Map<String, String> getAttributesFromAnnotation(Element el,
TypeElement annotation) {