root
/
spring-framework
mirror of https://github.com/spring-projects/spring-framework.git
1
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

Fix potential security risk when using Spring OXM 

Disable by default external entity resolution when using Spring OXM
with jaxb. This prevents a XML entity from being able to resolve a
local file on the host system.

See:
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

Issue: SPR-10806
(cherry picked from commit 7576274)
This commit is contained in:
Arjen Poutsma 2013-08-06 15:04:09 -07:00 committed by Phillip Webb
parent 8f4221deb3
commit 434735fbf6
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2CollectionHttpMessageConverter.java
View File

@ -224,7 +224,9 @@ public class Jaxb2CollectionHttpMessageConverter<T extends Collection>
* @return the created factory * @return the created factory
*/ */
protected XMLInputFactory createXmlInputFactory() { protected XMLInputFactory createXmlInputFactory() {
return XMLInputFactory.newInstance(); XMLInputFactory inputFactory = XMLInputFactory.newInstance();
inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false);
return inputFactory;
} }
} }