diff --git a/History.md b/History.md index 023b8606..8dafe13d 100644 --- a/History.md +++ b/History.md @@ -2,6 +2,9 @@ - #870 - #871 sec - #868 +- #729 +- #863 +- #731 2.17.0 ======= diff --git a/validator/src/main/java/org/mustangproject/validator/Validator.java b/validator/src/main/java/org/mustangproject/validator/Validator.java index c3372126..513e996f 100644 --- a/validator/src/main/java/org/mustangproject/validator/Validator.java +++ b/validator/src/main/java/org/mustangproject/validator/Validator.java @@ -61,11 +61,10 @@ public abstract class Validator { Source xmlData = new StreamSource(new ByteArrayInputStream(xmlRawData)); SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); try { - schemaFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); - schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); Schema schema = schemaFactory.newSchema(schemaFile); javax.xml.validation.Validator validator = schema.newValidator(); + validator.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); validator.validate(xmlData); } catch (SAXException e) { context.addResultItem(new ValidationResultItem(ESeverity.error, "schema validation fails:" + e)