corrected security so that schema validation with externa files *still work* but at the same time the sample file may not issue http-requests

History.md

@@ -2,6 +2,9 @@
 - #870
 - #871 sec
 - #868
+- #729
+- #863
+- #731
 
 2.17.0
 =======

validator/src/main/java/org/mustangproject/validator/Validator.java

@@ -61,11 +61,10 @@ public abstract class Validator {
 		Source xmlData = new StreamSource(new ByteArrayInputStream(xmlRawData));
 		SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
 		try {
-			schemaFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
 			schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
-			schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
 			Schema schema = schemaFactory.newSchema(schemaFile);
 			javax.xml.validation.Validator validator = schema.newValidator();
+			validator.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
 			validator.validate(xmlData);
 		} catch (SAXException e) {
 			context.addResultItem(new ValidationResultItem(ESeverity.error, "schema validation fails:" + e)