BZ1150634: switch off external-parameter-entity processing in XML parser

kiegroup · Jan 5, 2015 · be3968d · be3968d
1 parent 5641588
commit be3968d
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/...esigner-backend/src/main/java/org/jbpm/designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java b/...esigner-backend/src/main/java/org/jbpm/designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java
@@ -31,6 +31,7 @@ public JBPMBpmn2ResourceImpl(URI uri) {
         // Switch off DTD external entity processing
         Map parserFeatures = new HashMap();
         parserFeatures.put("http://xml.org/sax/features/external-general-entities", false);
+        parserFeatures.put("http://xml.org/sax/features/external-parameter-entities", false);
         this.getDefaultLoadOptions().put(XMLResource.OPTION_PARSER_FEATURES, parserFeatures);
 
         this.getDefaultSaveOptions().put(XMLResource.OPTION_ENCODING, "UTF-8");