Merge pull request #2121 from GDLMadushanka/security

Disable external entity support in javax.xml
wso2 · Dec 8, 2023 · a2a3908 · a2a3908
2 parents 47cf14f + 8dd2459
commit a2a3908
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/.../core/src/main/java/org/apache/synapse/mediators/transform/pfutils/TemplateProcessor.java b/.../core/src/main/java/org/apache/synapse/mediators/transform/pfutils/TemplateProcessor.java
@@ -533,6 +533,7 @@ protected void handleException(String msg) {
     public void readInputFactoryProperties() {
         //ignore DTDs for XML Input
         inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
+        inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
         inputFactory.setProperty(XMLInputFactory.IS_COALESCING, true);
         Map props = StAXUtils.loadFactoryProperties("XMLInputFactory.properties");
         if (props != null) {