demus/openhab-addons
1
0
Fork 0
mirror of https://github.com/openhab/openhab-addons.git synced 2025-02-04 03:14:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

[dwdunwetter] Handle possible XXE injection (#15466)

Browse Source 
XMLInputFactory: Disable properties IS_SUPPORTING_EXTERNAL_ENTITIES and
SUPPORT_DTD which allow injecting external entities.

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
This commit is contained in:
Holger Friedrich 2023-08-29 18:50:13 +02:00 committed by GitHub
parent 5e1f24c54f
commit d3c07344d3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bundles/org.openhab.binding.dwdunwetter/src/main/java/org/openhab/binding/dwdunwetter/internal/dto/DwdWarningsData.java
View File

@ -119,6 +119,8 @@ public class DwdWarningsData {
try { try {
XMLInputFactory inputFactory = XMLInputFactory.newInstance(); XMLInputFactory inputFactory = XMLInputFactory.newInstance();
inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
XMLStreamReader reader = inputFactory.createXMLStreamReader(new StringReader(rawData)); XMLStreamReader reader = inputFactory.createXMLStreamReader(new StringReader(rawData));
XMLEventReader eventReader = inputFactory.createXMLEventReader(reader); XMLEventReader eventReader = inputFactory.createXMLEventReader(reader);
DwdWarningData gemeindeData = new DwdWarningData(); DwdWarningData gemeindeData = new DwdWarningData();