diff options
| author |   Dan Timoney <dtimoney@att.com> | 2020-10-19 15:35:27 -0400 |
|---|---|---|
| committer | Dan Timoney <dtimoney@att.com> | 2020-10-20 20:29:11 +0000 |
| commit | bb5d0eab13c2fbff0475ee6f977cb9c7ca7bf287 (patch) | |
| tree | 42d7cd3114f17db010f09579a18f14d3a796cfe6 /properties-node/provider/src | |
| parent | 42b7a94f71e6347f2c3fe85b2aecf6ab6a562370 (diff) | |
Disable external entities reference
Disable external entities reference in properties node XML parser
to avoid XXE vulnerability.
Change-Id: I5136dc7edb575d944dfe9fbab334629ec18c5d47
Issue-ID: CCSDK-2918
Signed-off-by: Dan Timoney <dtimoney@att.com>
Diffstat (limited to 'properties-node/provider/src')
| -rw-r--r-- | properties-node/provider/src/main/java/org/onap/ccsdk/sli/plugins/prop/XmlParser.java | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/properties-node/provider/src/main/java/org/onap/ccsdk/sli/plugins/prop/XmlParser.java b/properties-node/provider/src/main/java/org/onap/ccsdk/sli/plugins/prop/XmlParser.java index 68b2f74e..f48a21e9 100644 --- a/properties-node/provider/src/main/java/org/onap/ccsdk/sli/plugins/prop/XmlParser.java +++ b/properties-node/provider/src/main/java/org/onap/ccsdk/sli/plugins/prop/XmlParser.java @@ -28,6 +28,7 @@ import org.xml.sax.Attributes; import org.xml.sax.SAXException; import org.xml.sax.helpers.DefaultHandler; +import javax.xml.XMLConstants; import javax.xml.parsers.ParserConfigurationException; import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; @@ -57,6 +58,10 @@ public final class XmlParser { Handler handler = new Handler(listNameList); try { SAXParserFactory factory = SAXParserFactory.newInstance(); + + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); SAXParser saxParser = factory.newSAXParser(); InputStream in = new ByteArrayInputStream(s.getBytes()); saxParser.parse(in, handler); |