Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If an untrusted XML file is passed to one of the
Xml
class's public methods (unlikely but certainly possible), XML External Entity injection attacks are possible. This PR fixes that by disabling all known features that would cause the DocumentBuilderFactory or TransformerFactory to load external entities and doctypes. It also usesThreadLocal::withInitial
to fix failing cases ofUnusedCodeTest
; note that this doesn't work forInheritableThreadLocal
because that class has no equivalent method.References
Submitter checklist
#help-contributing
or a project-specific channel like#wiremock-java