NMS-15699: Prevent external xml entity loading

OpenNMS · Jul 17, 2023 · 5a3b0b6 · 5a3b0b6
1 parent 6ccc5de
commit 5a3b0b6
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/core/xml/src/main/java/org/opennms/core/xml/JaxbUtils.java b/core/xml/src/main/java/org/opennms/core/xml/JaxbUtils.java
@@ -305,9 +305,9 @@ public static <T> XMLFilter getXMLFilterForClass(final Class<T> clazz, boolean d
         final XMLReader xmlReader = XMLReaderFactory.createXMLReader();
         if (disableDOCTYPE) {
             xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-            xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
-            xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
         }
+        xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
         xmlReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
 
         filter.setParent(xmlReader);