HHH-13960 Add SAXReader sec features to match the defaults

hibernate · Apr 21, 2020 · 55e5479 · 55e5479
1 parent 60abc8a
commit 55e5479
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 2 deletions.
diff --git a/hibernate-core/src/main/java/org/hibernate/internal/util/xml/XMLHelper.java b/hibernate-core/src/main/java/org/hibernate/internal/util/xml/XMLHelper.java
@@ -59,6 +59,14 @@ public DocumentFactory getDocumentFactory() {
 
 	public SAXReader createSAXReader(ErrorLogger errorLogger, EntityResolver entityResolver) {
 		SAXReader saxReader = new SAXReader();
+		try {
+			saxReader.setFeature( "http://apache.org/xml/features/nonvalidating/load-external-dtd", false );
+			saxReader.setFeature( "http://xml.org/sax/features/external-general-entities", false );
+			saxReader.setFeature( "http://xml.org/sax/features/external-parameter-entities", false );
+		}
+		catch (Exception e) {
+			throw new RuntimeException( e );
+		}
 		saxReader.setMergeAdjacentText( true );
 		saxReader.setValidation( true );
 		saxReader.setErrorHandler( errorLogger );

diff --git a/hibernate-core/src/test/java/org/hibernate/test/annotations/xml/ejb3/Ejb3XmlTestCase.java b/hibernate-core/src/test/java/org/hibernate/test/annotations/xml/ejb3/Ejb3XmlTestCase.java
@@ -64,7 +64,11 @@ protected XMLContext getContext(String resourceName) throws Exception {
 
 	protected XMLContext getContext(InputStream is) throws Exception {
 		XMLContext xmlContext = new XMLContext( BootstrapContextImpl.INSTANCE );
-		Document doc = new SAXReader().read( is );
+		SAXReader reader = new SAXReader();
+		reader.setFeature( "http://apache.org/xml/features/nonvalidating/load-external-dtd", false );
+		reader.setFeature( "http://xml.org/sax/features/external-general-entities", false );
+		reader.setFeature( "http://xml.org/sax/features/external-parameter-entities", false );
+		Document doc = reader.read( is );
 		xmlContext.addDocument( doc );
 		return xmlContext;
 	}

diff --git a/hibernate-spatial/src/test/java/org/hibernate/spatial/testing/TestDataReader.java b/hibernate-spatial/src/test/java/org/hibernate/spatial/testing/TestDataReader.java
@@ -26,10 +26,13 @@ public List<TestDataElement> read(String fileName) {
 		List<TestDataElement> testDataElements = new ArrayList<TestDataElement>();
 		SAXReader reader = new SAXReader();
 		try {
+			reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false );
+			reader.setFeature("http://xml.org/sax/features/external-general-entities", false );
+			reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false );
 			Document document = reader.read( getInputStream( fileName ) );
 			addDataElements( document, testDataElements );
 		}
-		catch (DocumentException e) {
+		catch (Exception e) {
 			throw new RuntimeException( e );
 		}
 		return testDataElements;