Disable external entity support in javax.xml

Disable external entity support in javax.xml refer https://security.docs.wso2.com/en/latest/security-guidelines/secure-engineering-guidelines/secure-coding-guidlines/general-recommendations-for-secure-coding/#xmlinputfactory-stax-parser
wso2 · Dec 8, 2023 · 8dd2459 · 8dd2459
1 parent 47cf14f
commit 8dd2459
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/.../core/src/main/java/org/apache/synapse/mediators/transform/pfutils/TemplateProcessor.java b/.../core/src/main/java/org/apache/synapse/mediators/transform/pfutils/TemplateProcessor.java
@@ -533,6 +533,7 @@ protected void handleException(String msg) {
     public void readInputFactoryProperties() {
         //ignore DTDs for XML Input
         inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
+        inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
         inputFactory.setProperty(XMLInputFactory.IS_COALESCING, true);
         Map props = StAXUtils.loadFactoryProperties("XMLInputFactory.properties");
         if (props != null) {