[SECURITY-1900]

jenkinsci · Oct 31, 2020 · 267bb70 · 267bb70
1 parent 5ac6f61
commit 267bb70
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/visualworks_store/StoreChangeLogParser.java b/src/main/java/org/jenkinsci/plugins/visualworks_store/StoreChangeLogParser.java
@@ -50,6 +50,9 @@ public StoreChangeLogSet parse(AbstractBuild build, File file) throws IOExceptio
         blessingMap = new HashMap<String, StoreChangeLogEntry>();
 
         SAXReader reader = new SAXReader();
+        reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
 
         try {
             Document document = reader.read(file);