NO-ISSUE: Fix load external schemas vulnerability

The sonar reports https://rules.sonarsource.com/java/RSPEC-6374/ vulnerability for `jbpm/jbpm-flow-builder/src/main/java/org/jbpm/compiler/xml/core/ExtensibleXmlParser.java`
apache · Aug 29, 2023 · 25fdc3c · 25fdc3c
1 parent 0674e2e
commit 25fdc3c
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/jbpm/jbpm-flow-builder/src/main/java/org/jbpm/compiler/xml/core/ExtensibleXmlParser.java b/jbpm/jbpm-flow-builder/src/main/java/org/jbpm/compiler/xml/core/ExtensibleXmlParser.java
@@ -265,6 +265,7 @@ public Object read(final InputSource in) throws SAXException,
             try {
                 factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
                 factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+                factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
 
             } catch (ParserConfigurationException e) {
                 logger.warn("Unable to set parser features due to {}", e.getMessage());