Merge pull request #1168 from kermitt2/autofix/alert-41-d5c67df44f

Fix code scanning alert #41: Resolving XML external entity in user-controlled data
kermitt2 · Sep 22, 2024 · 1291337 · 1291337
2 parents f501033 + 044f158
commit 1291337
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/grobid-core/src/main/java/org/grobid/core/document/OPSService.java b/grobid-core/src/main/java/org/grobid/core/document/OPSService.java
@@ -116,8 +116,10 @@ public String descriptionRetrieval(String patentNumber) throws IOException,
 			spf.setValidating(false);
 			spf.setFeature("http://xml.org/sax/features/namespaces", false);
 			spf.setFeature("http://xml.org/sax/features/validation", false);
+			spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+			spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
 			//get a new instance of parser
-			XMLReader reader = XMLReaderFactory.createXMLReader();
+			XMLReader reader = spf.newSAXParser().getXMLReader();
 			reader.setEntityResolver(new EntityResolver() {
 				public InputSource resolveEntity(String publicId, String systemId) {
 					return new InputSource(