XML Parser - How to: disallow-doctype-decl set to false

[rocaver]

Using the "Get data from XML", I load the file and when I go to get the xpaths nodes I get the following: InvocationTargetException: Error scanning file [/home/tawa/Descargas/1.xml]! org.dom4j.DocumentException: Error on line 1 of document file:///home/tawa/Apps/hop/UTF-8 : DOCTYPE is disallowed when the feature "http://apache.org/xml/features/disallow-doctype-decl" set to true.
Root cause: SAXParseException: DOCTYPE is disallowed when the feature "http://apache.org/xml/features/disallow-doctype-decl" set to true.

How do I change disallow-doctype-decl set to false? Anyone?

[leehaut]

Hop’s Get data from XML always rejects DOCTYPE for security, so files with <!DOCTYPE> fail when scanning nodes. There’s no user switch for that path (XML_ALLOW_DOCTYPE_DECL doesn’t apply here). Fix: strip the DOCTYPE or type XPaths by hand; a proper fix needs a code change in Dom4JUtil.

Can you set disallow-doctype-decl to false?
For “Get data from XML” (including the UI that scans nodes): not via any user setting today.
Dom4JUtil hardcodes disallow-doctype-decl to true and does not read XML_ALLOW_DOCTYPE_DECL or a transform option.

[hansva]

We could add the UI options, but a lot of security teams will get mad at us because allowing the user to disable these types of options usually is a no-go

[leehaut]

Agreed — a user-facing “disable secure XML” option is a tough sell. Manual XPath / stripping DOCTYPE is fine for now. If anything, an admin-only setting (similar to -DXML_ALLOW_DOCTYPE_DECL=N/Y ) is more palatable than a GUI toggle.