DocumentHelper.parseText could be vulnerable to XML Injection

[s0m30ne]

The DocumentHelper.parseText could be used to convert Strings to a Document Object. But the function uses SAXReader to parse XML String which is vulnerable to XML Injection. To deal with this problem, we always using setFeature function to disllow doctype and entity. However you use the SAXReader directly and do not offer any function to allow users to config those features. So I think this is a problem here and if users used DocumentHelper.parse and the string to convert was controled by user input such as GET or POST parameters, the application would be vulnerable to XML Injection.

[FilipJirsak]

DocumentHelper.parseText() is only helper method, you should instantiate own SAXReader when you want to configure it. But you are right that helper method should be safe and if someone needs unsafe variant, they can use full SAXReader.
So following features are disabled now in DocumentHelper.parseText():

• http://apache.org/xml/features/nonvalidating/load-external-dtd
• http://xml.org/sax/features/external-general-entities
• http://xml.org/sax/features/external-parameter-entities

[superfofo]

this function can be merged into the version dom4j-2.0.2, so that the project which jdk version is under jdk8 can apply ?