[#702] Disable access to external entities in XML parsing

goldmansachs · Sep 9, 2024 · 3fa673d · 3fa673d
1 parent 007272b
commit 3fa673d
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/dmn-core/src/main/java/com/gs/dmn/serialization/jackson/NSElementSerializer.java b/dmn-core/src/main/java/com/gs/dmn/serialization/jackson/NSElementSerializer.java
@@ -28,6 +28,7 @@ public void serialize(NSElement element, JsonGenerator gen, SerializerProvider s
     private static String toXml(Element element) {
         try {
             TransformerFactory factory = TransformerFactory.newInstance();
+            factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
             factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
             factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
             StringWriter writer = new StringWriter();