DanielLeens commented on code in PR #11250:
URL: https://github.com/apache/seatunnel/pull/11250#discussion_r3509701862
##########
seatunnel-connectors-v2/connector-file/connector-file-base/src/main/java/org/apache/seatunnel/connectors/seatunnel/file/source/reader/XmlReadStrategy.java:
##########
@@ -104,7 +121,7 @@ public void readProcess(
Map<String, String> partitionsMap,
String currentFileName)
throws IOException {
- SAXReader saxReader = new SAXReader();
+ SAXReader saxReader = createSecureSaxReader();
Review Comment:
Thanks for the pointer. For this PR I kept the fix dependency-free on
purpose so we can unblock the deterministic XXE hardening issue in
`connector-file-base` without introducing a new library edge into SeaTunnel. If
Commons XML lands and becomes a better long-term fit later, we can evaluate
that separately, but for this narrow fix I prefer to keep the local hardening
plus focused tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
