louisdevie/mustangproject
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

corrected security so that schema validation with externa files *still work* but at the same time the sample file may not issue http-requests

Browse Source
This commit is contained in:
jstaerk
2025-06-25 12:46:56 +02:00
parent 18173b8bc6
commit 5e5a01ff33
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
History.md
View File

@@ -2,6 +2,9 @@
- #870 - #870
- #871 sec - #871 sec
- #868 - #868
- #729
- #863
- #731
2.17.0 2.17.0
======= =======

3
validator/src/main/java/org/mustangproject/validator/Validator.java
View File

@@ -61,11 +61,10 @@ public abstract class Validator {
Source xmlData = new StreamSource(new ByteArrayInputStream(xmlRawData)); Source xmlData = new StreamSource(new ByteArrayInputStream(xmlRawData));
SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
try { try {
schemaFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
Schema schema = schemaFactory.newSchema(schemaFile); Schema schema = schemaFactory.newSchema(schemaFile);
javax.xml.validation.Validator validator = schema.newValidator(); javax.xml.validation.Validator validator = schema.newValidator();
validator.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
validator.validate(xmlData); validator.validate(xmlData);
} catch (SAXException e) { } catch (SAXException e) {
context.addResultItem(new ValidationResultItem(ESeverity.error, "schema validation fails:" + e) context.addResultItem(new ValidationResultItem(ESeverity.error, "schema validation fails:" + e)