disable external entities in ParsingValidator instance parsing - #332
Conversation
|
any update? |
|
see the comments in #331 - this is the same case in that I explicitly decided to leave the defaults insecure back then. |
|
makes sense, I hadn't clocked that this was a documented decision back in 2.6, so I won't push to change the default. happy to close this one, or rework it into an opt-in setting / configurer like you described on #331 if that's useful. whichever you prefer. |
Don't worry, it has been hidden well enough. I believe an opt-in and a more explicit warning in the javadocs may be fine. Together with #331 maybe the warnung should be at the package level. |
keep the 2.6.0 default of resolving external entities, add an opt-in setter and document the XXE risk at the package and class level
|
reworked this the same way as #331: default stays as-is, added an opt-in |
|
many thanks |
add release notes for #331 #332 #333 by @jmestwa-coder
ParsingValidator.validateInstance parses the instance document with a validating SAX parser that resolves external entities, so a DOCTYPE in the instance can read local files or hit URLs through SYSTEM entities. The schema/DTD to validate against is resolved separately via the Handler, the instance never needs its own external entities.
Per the discussion this keeps the 2.6.0 default unchanged and adds an opt-in instead of changing behavior for everyone:
setDisableExternalEntities(boolean)on ParsingValidator, defaultfalseso existing behavior is unchangedexternal-general-entitiesandexternal-parameter-entitieson the factory before the parser is created; DTD and schema validation are unaffectedpackage-info.javacovering both validators