fix LOGBACK-1465

Signed-off-by: Ceki Gulcu <ceki@qos.ch>
qos-ch · Sep 9, 2021 · e30dc08 · e30dc08
1 parent db1a652
commit e30dc08
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/logback-core/src/main/java/ch/qos/logback/core/joran/event/SaxEventRecorder.java b/logback-core/src/main/java/ch/qos/logback/core/joran/event/SaxEventRecorder.java
@@ -78,6 +78,9 @@ private SAXParser buildSaxParser() throws JoranException {
         try {
             SAXParserFactory spf = SAXParserFactory.newInstance();
             spf.setValidating(false);
+            //spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
             spf.setNamespaceAware(true);
             return spf.newSAXParser();
         } catch (Exception pce) {

diff --git a/logback-core/src/test/java/ch/qos/logback/core/joran/action/IncludeActionTest.java b/logback-core/src/test/java/ch/qos/logback/core/joran/action/IncludeActionTest.java
@@ -183,7 +183,8 @@ String copyToTemp(String in) throws IOException {
 
     @Test
     public void malformedURL() throws JoranException {
-        System.setProperty(INCLUDE_KEY, "htp://logback.qos.ch");
+    	String MALFORMED = "htp://logback.qos.ch";
+        System.setProperty(INCLUDE_KEY, MALFORMED);
         tc.doConfigure(TOP_BY_URL);
         assertEquals(Status.ERROR, statusChecker.getHighestLevel(0));
         assertTrue(statusChecker.containsException(MalformedURLException.class));
@@ -219,7 +220,10 @@ public void multiInclude() throws JoranException {
     @Test
     public void includeAsEntity() throws JoranException {
         tc.doConfigure(TOP_BY_ENTITY);
-        verifyConfig(new String[] { "EA", "EB" });  
+
+        // entity inclusion disabled
+        // verifyConfig(new String[] { "EA", "EB" });
+        verifyConfig(new String[] { });
     }
 
     void verifyConfig(String[] expected) {