Fix code scanning alert #41: Resolving XML external entity in user-co…

…ntrolled data Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
kermitt2 · Sep 22, 2024 · 044f158 · 044f158
1 parent f501033
commit 044f158
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/grobid-core/src/main/java/org/grobid/core/document/OPSService.java b/grobid-core/src/main/java/org/grobid/core/document/OPSService.java
@@ -116,8 +116,10 @@ public String descriptionRetrieval(String patentNumber) throws IOException,
 			spf.setValidating(false);
 			spf.setFeature("http://xml.org/sax/features/namespaces", false);
 			spf.setFeature("http://xml.org/sax/features/validation", false);
+			spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+			spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
 			//get a new instance of parser
-			XMLReader reader = XMLReaderFactory.createXMLReader();
+			XMLReader reader = spf.newSAXParser().getXMLReader();
 			reader.setEntityResolver(new EntityResolver() {
 				public InputSource resolveEntity(String publicId, String systemId) {
 					return new InputSource(