garydgregory commented on code in PR #647:
URL:
https://github.com/apache/commons-configuration/pull/647#discussion_r3943983596
##########
src/main/java/org/apache/commons/configuration2/XMLConfiguration.java:
##########
@@ -693,12 +695,26 @@ protected DocumentBuilder createDocumentBuilder() throws
ParserConfigurationExce
if (getDocumentBuilder() != null) {
return getDocumentBuilder();
}
- final DocumentBuilderFactory factory =
DocumentBuilderFactory.newInstance();
+ final DocumentBuilderFactory factory =
SecureDocumentBuilderFactory.newInstance();
if (isValidating()) {
factory.setValidating(true);
if (isSchemaValidation()) {
factory.setNamespaceAware(true);
factory.setAttribute(JAXP_SCHEMA_LANGUAGE, W3C_XML_SCHEMA);
+ try {
+ // Due to a bug, the JDK fails to mark schema documents
supplied by an entity resolver as resolver-created,
+ // so the accessExternalSchema check is applied to them
and denies access:
+ //
+ // - Old JDK 8 versions never mark them.
+ // - Newer JDK 8 and later versions only fail to mark
documents supplied by an EntityResolver2.
+ //
+ // Allowing all protocols only stops that check from
refusing the documents returned by the resolver:
+ // the parser never retrieves a schema itself, because the
Commons XML ignore-all resolver floor
+ // resolves every lookup the caller-supplied resolver
leaves unresolved to empty content.
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA,
"all");
Review Comment:
@ppkarwasz
Isn't this handled by the library now?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
