summaryrefslogtreecommitdiffstats
path: root/northbound
diff options
context:
space:
mode:
Diffstat (limited to 'northbound')
-rw-r--r--northbound/ueb-listener/src/main/java/org/onap/ccsdk/sli/northbound/uebclient/SdncUebCallback.java7
1 files changed, 4 insertions, 3 deletions
diff --git a/northbound/ueb-listener/src/main/java/org/onap/ccsdk/sli/northbound/uebclient/SdncUebCallback.java b/northbound/ueb-listener/src/main/java/org/onap/ccsdk/sli/northbound/uebclient/SdncUebCallback.java
index 8c3a290e0..ba060924e 100644
--- a/northbound/ueb-listener/src/main/java/org/onap/ccsdk/sli/northbound/uebclient/SdncUebCallback.java
+++ b/northbound/ueb-listener/src/main/java/org/onap/ccsdk/sli/northbound/uebclient/SdncUebCallback.java
@@ -1194,9 +1194,10 @@ public class SdncUebCallback implements INotificationCallback {
outFile = File.createTempFile("tmp", "xml");
TransformerFactory factory = TransformerFactory.newInstance();
- factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- //factory.setFeature("http://xml.org/sax/features/external-general-entities", false); -- breaks transform
- //factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ // To remediate XML external entity vulnerability, completely disable external entities declarations:
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
Source xslt = new StreamSource(new File(xsltPath));
Transformer transformer = factory.newTransformer(xslt);
Source text = new StreamSource(inFile);