Skip to content

Commit 3e0eedc

Browse files
committed
AmazonS3: Do not accept DOCTYPE and entities
This follows OWASP recommendations in https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html Change-Id: I3d47debf14d95c8189d51256b4eb2ba991279452
1 parent 07d00f6 commit 3e0eedc

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

org.eclipse.jgit/src/org/eclipse/jgit/transport/AmazonS3.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -760,6 +760,15 @@ void list() throws IOException {
760760
SAXParserFactory saxParserFactory = SAXParserFactory
761761
.newInstance();
762762
saxParserFactory.setNamespaceAware(true);
763+
saxParserFactory.setFeature(
764+
"http://xml.org/sax/features/external-general-entities", //$NON-NLS-1$
765+
false);
766+
saxParserFactory.setFeature(
767+
"http://xml.org/sax/features/external-parameter-entities", //$NON-NLS-1$
768+
false);
769+
saxParserFactory.setFeature(
770+
"http://apache.org/xml/features/disallow-doctype-decl", //$NON-NLS-1$
771+
true);
763772
xr = saxParserFactory.newSAXParser().getXMLReader();
764773
} catch (SAXException | ParserConfigurationException e) {
765774
throw new IOException(

0 commit comments

Comments
 (0)