From fb443c4f8e218dadc9c8d0c85ef61cf4be8f71ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= Date: Tue, 6 Aug 2024 19:49:53 +0100 Subject: [PATCH] cid#1616070 XML external entity processing enabled MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit reformat to get it seen by scanner Change-Id: I9b9a40078e6474d87f4fe7cc6b19992023e24144 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171652 Reviewed-by: Caolán McNamara Tested-by: Jenkins --- .../xmerge/converter/dom/DOMDocument.java | 26 +++++++++++-------- .../xmerge/converter/xml/OfficeDocument.java | 26 +++++++++++-------- .../xml/xslt/DocumentDeserializerImpl.java | 26 +++++++++++-------- .../xml/xslt/DocumentSerializerImpl.java | 26 +++++++++++-------- .../util/registry/ConverterInfoReader.java | 26 +++++++++++-------- 5 files changed, 75 insertions(+), 55 deletions(-) diff --git a/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/dom/DOMDocument.java b/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/dom/DOMDocument.java index 5877b99d3de9..c49b6560f192 100644 --- a/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/dom/DOMDocument.java +++ b/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/dom/DOMDocument.java @@ -47,18 +47,22 @@ public class DOMDocument private static DocumentBuilderFactory makeFactory() { DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - String[] featuresToDisable = { - "http://xml.org/sax/features/external-general-entities", - "http://xml.org/sax/features/external-parameter-entities", - "http://apache.org/xml/features/nonvalidating/load-external-dtd" - }; + try { + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); + } - for (String feature : featuresToDisable) { - try { - factory.setFeature(feature, false); - } catch (ParserConfigurationException e) { - Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); - } + try { + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); + } + + try { + factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); } try { diff --git a/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/OfficeDocument.java b/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/OfficeDocument.java index 49695e173da3..1fd074cccd5d 100644 --- a/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/OfficeDocument.java +++ b/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/OfficeDocument.java @@ -62,18 +62,22 @@ public abstract class OfficeDocument private static DocumentBuilderFactory makeFactory() { DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - String[] featuresToDisable = { - "http://xml.org/sax/features/external-general-entities", - "http://xml.org/sax/features/external-parameter-entities", - "http://apache.org/xml/features/nonvalidating/load-external-dtd" - }; + try { + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); + } - for (String feature : featuresToDisable) { - try { - factory.setFeature(feature, false); - } catch (ParserConfigurationException e) { - Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); - } + try { + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); + } + + try { + factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); } try { diff --git a/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/xslt/DocumentDeserializerImpl.java b/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/xslt/DocumentDeserializerImpl.java index d88d1f35c10b..ebca456a462b 100644 --- a/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/xslt/DocumentDeserializerImpl.java +++ b/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/xslt/DocumentDeserializerImpl.java @@ -62,18 +62,22 @@ public final class DocumentDeserializerImpl private static DocumentBuilderFactory makeFactory() { DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - String[] featuresToDisable = { - "http://xml.org/sax/features/external-general-entities", - "http://xml.org/sax/features/external-parameter-entities", - "http://apache.org/xml/features/nonvalidating/load-external-dtd" - }; + try { + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); + } - for (String feature : featuresToDisable) { - try { - factory.setFeature(feature, false); - } catch (ParserConfigurationException e) { - Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); - } + try { + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); + } + + try { + factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); } try { diff --git a/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/xslt/DocumentSerializerImpl.java b/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/xslt/DocumentSerializerImpl.java index 4d7e42b655fa..a47869ddfb92 100644 --- a/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/xslt/DocumentSerializerImpl.java +++ b/xmerge/source/xmerge/java/org/openoffice/xmerge/converter/xml/xslt/DocumentSerializerImpl.java @@ -72,18 +72,22 @@ public final class DocumentSerializerImpl private static DocumentBuilderFactory makeFactory() { DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - String[] featuresToDisable = { - "http://xml.org/sax/features/external-general-entities", - "http://xml.org/sax/features/external-parameter-entities", - "http://apache.org/xml/features/nonvalidating/load-external-dtd" - }; + try { + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); + } - for (String feature : featuresToDisable) { - try { - factory.setFeature(feature, false); - } catch (ParserConfigurationException e) { - Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); - } + try { + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); + } + + try { + factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); } try { diff --git a/xmerge/source/xmerge/java/org/openoffice/xmerge/util/registry/ConverterInfoReader.java b/xmerge/source/xmerge/java/org/openoffice/xmerge/util/registry/ConverterInfoReader.java index baf71820bd51..06f4d6239012 100644 --- a/xmerge/source/xmerge/java/org/openoffice/xmerge/util/registry/ConverterInfoReader.java +++ b/xmerge/source/xmerge/java/org/openoffice/xmerge/util/registry/ConverterInfoReader.java @@ -54,18 +54,22 @@ public class ConverterInfoReader { private static DocumentBuilderFactory makeFactory() { DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - String[] featuresToDisable = { - "http://xml.org/sax/features/external-general-entities", - "http://xml.org/sax/features/external-parameter-entities", - "http://apache.org/xml/features/nonvalidating/load-external-dtd" - }; + try { + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); + } - for (String feature : featuresToDisable) { - try { - factory.setFeature(feature, false); - } catch (ParserConfigurationException e) { - Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); - } + try { + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); + } + + try { + factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + } catch (ParserConfigurationException e) { + Debug.log(Debug.ERROR, "Exception when calling setFeature: ", e); } try {