Merge pull request #177 from shado23/safe-defaults

scala · Mar 4, 2021 · 97fabfb · 97fabfb
2 parents 43dc3ef + 0ba347b
commit 97fabfb
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/shared/src/main/scala/scala/xml/factory/XMLLoader.scala b/shared/src/main/scala/scala/xml/factory/XMLLoader.scala
@@ -30,7 +30,13 @@ trait XMLLoader[T <: Node] {
   private lazy val parserInstance = new ThreadLocal[SAXParser] {
     override def initialValue = {
       val parser = SAXParserFactory.newInstance()
-
+      parser.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true)
+      parser.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false)
+      parser.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
+      parser.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
+      parser.setFeature("http://xml.org/sax/features/external-general-entities", false)
+      parser.setFeature("http://xml.org/sax/features/resolve-dtd-uris", false)
+      parser.setXIncludeAware(false)
       parser.setNamespaceAware(false)
       parser.newSAXParser()
     }