Issue #6133: Disable XML External Entity load in XmlUtil.java in tests

checkstyle · Mar 16, 2019 · 7e2b7f5 · 7e2b7f5
1 parent e7d4471
commit 7e2b7f5
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/src/main/java/com/puppycrawl/tools/checkstyle/XmlLoader.java b/src/main/java/com/puppycrawl/tools/checkstyle/XmlLoader.java
@@ -119,10 +119,10 @@ public static final class LoadExternalDtdFeatureProvider {
         public static final String ENABLE_EXTERNAL_DTD_LOAD = "checkstyle.enableExternalDtdLoad";
 
         /** Feature that enables loading external DTD when loading XML files. */
-        private static final String LOAD_EXTERNAL_DTD =
+        public static final String LOAD_EXTERNAL_DTD =
                 "http://apache.org/xml/features/nonvalidating/load-external-dtd";
         /** Feature that enables including external general entities in XML files. */
-        private static final String EXTERNAL_GENERAL_ENTITIES =
+        public static final String EXTERNAL_GENERAL_ENTITIES =
                 "http://xml.org/sax/features/external-general-entities";
 
         /** Stop instances being created. **/

diff --git a/src/test/java/com/puppycrawl/tools/checkstyle/internal/utils/XmlUtil.java b/src/test/java/com/puppycrawl/tools/checkstyle/internal/utils/XmlUtil.java
@@ -34,6 +34,8 @@
 import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
 
+import com.puppycrawl.tools.checkstyle.XmlLoader;
+
 /**
  * XmlUtil.
  * @noinspection ClassOnlyUsedInOnePackage
@@ -49,6 +51,10 @@ public static Document getRawXml(String fileName, String code, String unserializ
         try {
             final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
             factory.setValidating(false);
+            factory.setFeature(
+                    XmlLoader.LoadExternalDtdFeatureProvider.EXTERNAL_GENERAL_ENTITIES, false);
+            factory.setFeature(
+                    XmlLoader.LoadExternalDtdFeatureProvider.LOAD_EXTERNAL_DTD, false);
 
             final DocumentBuilder builder = factory.newDocumentBuilder();