Skip to content
This repository was archived by the owner on Sep 13, 2022. It is now read-only.

Commit 5641588

Browse files
author
Jeremy Lindop
committed
BZ1158017: fix XXE vulnerability when importing a BP from a bpmn2 (XML) file.
1 parent b4645ac commit 5641588

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

Diff for: jbpm-designer-backend/src/main/java/org/jbpm/designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java

+5
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ public JBPMBpmn2ResourceImpl(URI uri) {
2828
this.getDefaultLoadOptions().put(XMLResource.OPTION_DISABLE_NOTIFY, true);
2929
this.getDefaultLoadOptions().put(XMLResource.OPTION_USE_XML_NAME_TO_FEATURE_MAP, xmlNameToFeatureMap);
3030

31+
// Switch off DTD external entity processing
32+
Map parserFeatures = new HashMap();
33+
parserFeatures.put("http://xml.org/sax/features/external-general-entities", false);
34+
this.getDefaultLoadOptions().put(XMLResource.OPTION_PARSER_FEATURES, parserFeatures);
35+
3136
this.getDefaultSaveOptions().put(XMLResource.OPTION_ENCODING, "UTF-8");
3237
this.getDefaultSaveOptions().put(XMLResource.OPTION_PROCESS_DANGLING_HREF, XMLResource.OPTION_PROCESS_DANGLING_HREF_DISCARD);
3338
}

0 commit comments

Comments
 (0)