From c01c3660164854afe2a6a6453a1b4115f4fd31a9 Mon Sep 17 00:00:00 2001 From: Detlef Sander Date: Wed, 22 Oct 2025 10:49:55 +0200 Subject: [PATCH] fixes feature secure processing not working --- .../ZUGFeRD/ZUGFeRDVisualizer.java | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/library/src/main/java/org/mustangproject/ZUGFeRD/ZUGFeRDVisualizer.java b/library/src/main/java/org/mustangproject/ZUGFeRD/ZUGFeRDVisualizer.java index fda79d55..ec699252 100644 --- a/library/src/main/java/org/mustangproject/ZUGFeRD/ZUGFeRDVisualizer.java +++ b/library/src/main/java/org/mustangproject/ZUGFeRD/ZUGFeRDVisualizer.java @@ -107,9 +107,23 @@ public class ZUGFeRDVisualizer { DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); //REDHAT //https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf - dbf.setAttribute(XMLConstants.FEATURE_SECURE_PROCESSING, true); - dbf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); - dbf.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); + dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); + try + { + dbf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); + } + catch (IllegalArgumentException e) + { + LOGGER.warn("Property: \"Access external DTD\" not supported."); + } + try + { + dbf.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); + } + catch (IllegalArgumentException e) + { + LOGGER.warn("Property: \"Access external schema\" not supported."); + } //OWASP //https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html