diff --git a/src/KM_xml.cpp b/src/KM_xml.cpp index 9c45cde..fe2364b 100644 --- a/src/KM_xml.cpp +++ b/src/KM_xml.cpp @@ -988,6 +988,15 @@ Kumu::XMLElement::ParseString(const char* document, ui32_t doc_len) return errorCount > 0 ? false : true; } + +class IgnoreDTDResolver : public xercesc::EntityResolver { +public: + InputSource* resolveEntity(const XMLCh* const, const XMLCh* const) override { + static const XMLByte dummy[] = ""; + return new xercesc::MemBufInputSource(dummy, 0, "dummy-dtd", false); + } +}; + // bool Kumu::XMLElement::ParseFirstFromString(const char* document, ui32_t doc_len) @@ -1002,7 +1011,7 @@ Kumu::XMLElement::ParseFirstFromString(const char* document, ui32_t doc_len) int errorCount = 0; SAXParser* parser = new SAXParser(); - parser->setValidationScheme(SAXParser::Val_Always); + parser->setValidationScheme(SAXParser::Val_Never); parser->setDoNamespaces(true); // optional MyTreeHandler* docHandler = new MyTreeHandler(this); @@ -1010,6 +1019,10 @@ Kumu::XMLElement::ParseFirstFromString(const char* document, ui32_t doc_len) parser->setErrorHandler(docHandler); XMLPScanToken token; + // Ignore references to DTD files + IgnoreDTDResolver resolver; + parser->setEntityResolver(&resolver); + try { MemBufInputSource xmlSource(reinterpret_cast(document),