ppkarwasz commented on PR #742: URL: https://github.com/apache/creadur-rat/pull/742#issuecomment-5982073536
High @ottlinger, > The features > ``` > factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); > factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); > ``` > do not seem to be set in SecureTransformerFactory, but only the `FEATURE_SECURE_PROCESSING=true`. Commons Secure XML blocks external access [by contract](https://commons.apache.org/proper/commons-secure-xml/threat_model.html), so you don't need to worry any more about these settings. The concrete mechanisms blocking the external access are: 1. Every `StreamSource` you pass as a parameter is rewritten into a `SAXSource` with a *hardened* `XMLReader`. `ACCESS_EXTERNAL_DTD` only applies to `Source`s without a parser. 2. We set an ignore-all `URIResolver` on the factory, which is consulted before `ACCESS_EXTERNAL_STYLESHEET` is applied. `ACCESS_EXTERNAL_STYLESHEET` only applies to resources that are not generated by a resolver. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
