Skip to content
This repository has been archived by the owner on Sep 13, 2022. It is now read-only.

Commit

Permalink
BZ1158017: fix XXE vulnerability when importing a BP from a bpmn2 (XM…
Browse files Browse the repository at this point in the history
…L) file.
  • Loading branch information
Jeremy Lindop committed Jan 5, 2015
1 parent b4645ac commit 5641588
Showing 1 changed file with 5 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,11 @@ public JBPMBpmn2ResourceImpl(URI uri) {
this.getDefaultLoadOptions().put(XMLResource.OPTION_DISABLE_NOTIFY, true);
this.getDefaultLoadOptions().put(XMLResource.OPTION_USE_XML_NAME_TO_FEATURE_MAP, xmlNameToFeatureMap);

// Switch off DTD external entity processing
Map parserFeatures = new HashMap();
parserFeatures.put("http://xml.org/sax/features/external-general-entities", false);
this.getDefaultLoadOptions().put(XMLResource.OPTION_PARSER_FEATURES, parserFeatures);

this.getDefaultSaveOptions().put(XMLResource.OPTION_ENCODING, "UTF-8");
this.getDefaultSaveOptions().put(XMLResource.OPTION_PROCESS_DANGLING_HREF, XMLResource.OPTION_PROCESS_DANGLING_HREF_DISCARD);
}
Expand Down

0 comments on commit 5641588

Please sign in to comment.