Disable external DTDs for SAXParserFactory

3dcitydb · Jun 20, 2022 · a82199a · a82199a
1 parent 1ab40b0
commit a82199a
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/impexp-util/src/main/java/org/citydb/util/xml/SecureXMLProcessors.java b/impexp-util/src/main/java/org/citydb/util/xml/SecureXMLProcessors.java
@@ -50,6 +50,8 @@ public static SAXParserFactory newSAXParserFactory() throws SAXNotSupportedExcep
         factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
         factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
         return factory;
     }