Merge pull request #706 from goldmansachs/xml-security

Disable access to external entities in XML parsing
goldmansachs · Sep 9, 2024 · e64addd · e64addd
2 parents 1bf376d + 83b70d9
commit e64addd
Showing 1 changed file with 1 addition and 3 deletions.
diff --git a/dmn-core/src/main/java/com/gs/dmn/serialization/jackson/NSElementSerializer.java b/dmn-core/src/main/java/com/gs/dmn/serialization/jackson/NSElementSerializer.java
@@ -28,10 +28,8 @@ public void serialize(NSElement element, JsonGenerator gen, SerializerProvider s
     private static String toXml(Element element) {
         try {
             TransformerFactory factory = TransformerFactory.newInstance();
-            factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-            factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
             factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
-            factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+            factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
             StringWriter writer = new StringWriter();
             Transformer transformer = factory.newTransformer();
             transformer.transform(new DOMSource(element), new StreamResult(writer));