FOP-3168: Add secure processing for XSL input

apache · Mar 5, 2024 · d96ba9a · d96ba9a
1 parent cb26fed
commit d96ba9a
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/fop-core/src/main/java/org/apache/fop/cli/InputHandler.java b/fop-core/src/main/java/org/apache/fop/cli/InputHandler.java
@@ -26,6 +26,7 @@
 import java.lang.reflect.InvocationTargetException;
 import java.util.Vector;
 
+import javax.xml.XMLConstants;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParserFactory;
 import javax.xml.transform.ErrorListener;
@@ -265,6 +266,7 @@ protected void transformTo(Result result) throws FOPException {
         try {
             // Setup XSLT
             TransformerFactory factory = TransformerFactory.newInstance();
+            factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
             Transformer transformer;
 
             Source xsltSource = createXSLTSource();