CASC-165

disable DTD reading.
joshbeitelspacher · Oct 31, 2011 · a19c27f · a19c27f
1 parent 80693a3
commit a19c27f
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/cas-client-core/src/main/java/org/jasig/cas/client/util/XmlUtils.java b/cas-client-core/src/main/java/org/jasig/cas/client/util/XmlUtils.java
@@ -53,7 +53,9 @@ public final class XmlUtils {
      */
     public static XMLReader getXmlReader() {
         try {
-            return XMLReaderFactory.createXMLReader();
+            final XMLReader reader = XMLReaderFactory.createXMLReader();
+            reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            return reader;
         } catch (final SAXException e) {
             throw new RuntimeException("Unable to create XMLReader", e);
         }