From 5e5a01ff33955a86db7b3e6644db395e9251a256 Mon Sep 17 00:00:00 2001 From: jstaerk Date: Wed, 25 Jun 2025 12:46:56 +0200 Subject: [PATCH] corrected security so that schema validation with externa files *still work* but at the same time the sample file may not issue http-requests --- History.md | 3 +++ .../src/main/java/org/mustangproject/validator/Validator.java | 3 +-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/History.md b/History.md index 023b8606..8dafe13d 100644 --- a/History.md +++ b/History.md @@ -2,6 +2,9 @@ - #870 - #871 sec - #868 +- #729 +- #863 +- #731 2.17.0 ======= diff --git a/validator/src/main/java/org/mustangproject/validator/Validator.java b/validator/src/main/java/org/mustangproject/validator/Validator.java index c3372126..513e996f 100644 --- a/validator/src/main/java/org/mustangproject/validator/Validator.java +++ b/validator/src/main/java/org/mustangproject/validator/Validator.java @@ -61,11 +61,10 @@ public abstract class Validator { Source xmlData = new StreamSource(new ByteArrayInputStream(xmlRawData)); SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); try { - schemaFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); - schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); Schema schema = schemaFactory.newSchema(schemaFile); javax.xml.validation.Validator validator = schema.newValidator(); + validator.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); validator.validate(xmlData); } catch (SAXException e) { context.addResultItem(new ValidationResultItem(ESeverity.error, "schema validation fails:" + e)