diff options
| -rw-r--r-- | core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java b/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java index adec7b27d..fdceaad55 100644 --- a/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java +++ b/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java @@ -598,6 +598,9 @@ public class SvcLogicParser { } SAXParserFactory factory = SAXParserFactory.newInstance(); + // To remediate XML external entity vulnerability, completely disable external entities declarations: + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); if (schema != null) { factory.setNamespaceAware(true); |