aboutsummaryrefslogtreecommitdiffstats
path: root/asdctool
diff options
context:
space:
mode:
authorNeil Derraugh <neil.derraugh@yoppworks.com>2020-06-08 15:45:58 -0400
committerOfir Sonsino <ofir.sonsino@intl.att.com>2020-06-10 08:23:38 +0000
commitc8a11265085b1342c4efa03a9985d9fd9ca203a3 (patch)
tree69722d1c38d2de8f6b0648e869a5510f82d5fc3c /asdctool
parent6cfebc0867b2f21a401f55734aba30eb245e3c70 (diff)
Set properties on XML parsers to prevent XXE attack
- Set ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_SCHEMA properties on XML parsers to prevent XXE attacks Issue-ID: SDC-3106 Signed-off-by: Neil Derraugh <neil.derraugh@yoppworks.com> Change-Id: If4e835858dd3d718d37b3ee41fb2fd0c94574c24
Diffstat (limited to 'asdctool')
-rw-r--r--asdctool/src/main/java/org/openecomp/sdc/asdctool/impl/GraphMLDataAnalyzer.java4
1 files changed, 4 insertions, 0 deletions
diff --git a/asdctool/src/main/java/org/openecomp/sdc/asdctool/impl/GraphMLDataAnalyzer.java b/asdctool/src/main/java/org/openecomp/sdc/asdctool/impl/GraphMLDataAnalyzer.java
index 312d862747..d8642ebf54 100644
--- a/asdctool/src/main/java/org/openecomp/sdc/asdctool/impl/GraphMLDataAnalyzer.java
+++ b/asdctool/src/main/java/org/openecomp/sdc/asdctool/impl/GraphMLDataAnalyzer.java
@@ -20,6 +20,7 @@
package org.openecomp.sdc.asdctool.impl;
+import javax.xml.XMLConstants;
import org.apache.poi.hssf.usermodel.HSSFWorkbook;
import org.apache.poi.ss.usermodel.Row;
import org.apache.poi.ss.usermodel.Sheet;
@@ -69,6 +70,9 @@ public class GraphMLDataAnalyzer {
private String analyzeGraphMLData(String mlFileLocation) throws JDOMException, IOException {
// Parse ML file
SAXBuilder builder = new SAXBuilder();
+ builder.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ builder.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+
File xmlFile = new File(mlFileLocation);
Document document = builder.build(xmlFile);