Disable external entity processing

apache · Feb 17, 2024 · e8a67db · e8a67db
1 parent 71f1916
commit e8a67db
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/api/src/main/java/javax/jdo/JDOHelper.java b/api/src/main/java/javax/jdo/JDOHelper.java
@@ -367,6 +367,7 @@ public static Object getVersion(Object pc) {
       return IMPL_HELPER.nonBinaryCompatibleGet(pc, getVersion);
     }
   }
+
   /**
    * Tests whether the parameter instance is dirty.
    *
@@ -1143,6 +1144,11 @@ protected static DocumentBuilderFactory getDocumentBuilderFactory() {
 
   protected static DocumentBuilderFactory getDefaultDocumentBuilderFactory() {
     DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+    try {
+      factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+    } catch (ParserConfigurationException e) {
+      throw new JDOFatalUserException(e.getMessage());
+    }
     factory.setIgnoringComments(true);
     factory.setNamespaceAware(true);
     factory.setValidating(false);