snoopdave opened a new pull request, #173:
URL: https://github.com/apache/roller/pull/173
Several call sites each construct their own JDOM `SAXBuilder`, with
inconsistent
parser settings. This change consolidates them behind one shared,
consistently-configured builder.
## What changed
- Add `SafeSAXBuilder` (extends `SAXBuilder`) configured with secure
processing
enabled, document type declarations disallowed, external entity and
external
DTD resolution disabled, and entity expansion disabled.
- Apply it at the OPML bookmark import and the retained internal parsers
(`MenuHelper`, `RuntimeConfigDefsParser`, `ThemeMetadataParser`).
- Leave `Trackback.java` untouched; that file is removed separately.
Note for the release notes: OPML documents carrying a DOCTYPE are now
rejected
and will no longer import. OPML does not require a DOCTYPE.
## Tests
`SafeSAXBuilderTest` asserts the parser contract directly, and
`BookmarkImportParsingTest` exercises it through the import path, including
that
ordinary OPML still imports and that documents with external entities store
no
entity content.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
