summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java3
1 files changed, 3 insertions, 0 deletions
diff --git a/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java b/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java
index adec7b27d..fdceaad55 100644
--- a/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java
+++ b/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java
@@ -598,6 +598,9 @@ public class SvcLogicParser {
}
SAXParserFactory factory = SAXParserFactory.newInstance();
+ // To remediate XML external entity vulnerability, completely disable external entities declarations:
+ factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
if (schema != null) {
factory.setNamespaceAware(true);