Merge pull request #285 from arunvenmany-ibm/sast_issue_fix_1.0

Sast issue fix 1.0
OpenLiberty · Aug 7, 2024 · 4329148 · 4329148
2 parents 229f707 + a42af18
commit 4329148
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/lemminx-liberty/src/main/java/io/openliberty/tools/langserver/lemminx/util/XmlReader.java b/lemminx-liberty/src/main/java/io/openliberty/tools/langserver/lemminx/util/XmlReader.java
@@ -25,12 +25,12 @@
 import java.util.Set;
 import java.util.logging.Logger;
 
+import javax.xml.XMLConstants;
 import javax.xml.stream.XMLEventReader;
 import javax.xml.stream.XMLInputFactory;
 import javax.xml.stream.XMLStreamException;
 import javax.xml.stream.events.Characters;
 import javax.xml.stream.events.XMLEvent;
-import javax.xml.transform.stream.StreamSource;
 
 public class XmlReader {
     private static final Logger LOGGER = Logger.getLogger(XmlReader.class.getName());
@@ -62,7 +62,7 @@ public static boolean hasServerRoot(File xmlFile) {
             XMLEventReader reader = null;
 
             try (FileInputStream fis = new FileInputStream(xmlFile)) {
-                reader = factory.createXMLEventReader(new StreamSource(fis));
+                reader = factory.createXMLEventReader(fis);
                 while (reader.hasNext()) {
                     XMLEvent nextEvent = reader.nextEvent();
                     if (nextEvent.isStartElement()) {
@@ -87,12 +87,13 @@ public static boolean hasServerRoot(File xmlFile) {
     }
 
     private static XMLInputFactory getXmlInputFactory() {
-        XMLInputFactory factory = XMLInputFactory.newFactory();
+        XMLInputFactory factory = XMLInputFactory.newInstance();
         try {
             factory.setProperty(XMLInputFactory.IS_VALIDATING, Boolean.FALSE);
             factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
             factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
             factory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.FALSE);
+            factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
         } catch (Exception e) {
             LOGGER.warning("Could not set properties on XMLInputFactory.");
         }
@@ -118,7 +119,7 @@ public static Map<String, String> getElementValues(Path file, Set<String> elemen
         XMLInputFactory factory = getXmlInputFactory();
         XMLEventReader reader = null;
         try {
-            reader = factory.createXMLEventReader(new StreamSource(new FileInputStream(file.toFile())));
+            reader = factory.createXMLEventReader(new FileInputStream(file.toFile()));
             while (reader.hasNext()) {
                 XMLEvent event = reader.nextEvent();
                 if (!event.isStartElement()) {