louisdevie/mustangproject
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

removed disabling of required features

Browse Source
This commit is contained in:
jstaerk
2025-04-14 10:13:32 +02:00
parent 5a39e50bcf
commit 060aca216a
2 changed files with 1 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
validator/src/main/java/org/mustangproject/validator/Validator.java
View File

@@ -61,10 +61,8 @@ public abstract class Validator {
Source xmlData = new StreamSource(new ByteArrayInputStream(xmlRawData)); Source xmlData = new StreamSource(new ByteArrayInputStream(xmlRawData));
SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
try { try {
schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); // schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
schemaFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); schemaFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
schemaFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
schemaFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
Schema schema = schemaFactory.newSchema(schemaFile); Schema schema = schemaFactory.newSchema(schemaFile);
javax.xml.validation.Validator validator = schema.newValidator(); javax.xml.validation.Validator validator = schema.newValidator();
validator.validate(xmlData); validator.validate(xmlData);

1
validator/src/main/java/org/mustangproject/validator/ZUGFeRDValidator.java
View File

@@ -152,7 +152,6 @@ public class ZUGFeRDValidator {
//OWASP //OWASP
//https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html //https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
// Disable external DTDs as well // Disable external DTDs as well
dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);