azalea/kotlin-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Configure SAXParserFactory to avoid XXE references

Browse Source 
#KT-51519 Fixed
This commit is contained in:
Alexander Udalov
2022-03-08 15:02:45 +01:00
parent d01e6b61a3
commit 9c78d57de2
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
compiler/cli/cli-common/src/org/jetbrains/kotlin/cli/common/modules/ModuleXmlParser.java
+6 -1
View File
@@ -85,7 +85,12 @@ public class ModuleXmlParser {
private ModuleChunk parse(@NotNull InputStream xml) {
try {
setCurrentState(initial);
SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
SAXParser saxParser = factory.newSAXParser();
saxParser.parse(xml, new DelegatedSaxHandler() {
@NotNull
@Override