garydgregory commented on code in PR #766:
URL: https://github.com/apache/commons-text/pull/766#discussion_r3945172558
##########
src/main/java/org/apache/commons/text/lookup/XmlStringLookup.java:
##########
@@ -128,14 +130,21 @@ public String lookup(final String key) {
}
final String documentPath = keys[0];
final String xpath = StringUtils.substringAfterLast(key, SPLIT_CH);
- final DocumentBuilderFactory dbFactory =
DocumentBuilderFactory.newInstance();
+ // The secure factory installs a non-removable resolver floor that
ignores the JAXP access properties,
+ // so the documented opt-outs keep a plain factory: a feature map
without secure processing, or the
+ // standard javax.xml.accessExternalDTD system property re-allowing
external access.
+ final boolean secure =
Boolean.TRUE.equals(xmlFactoryFeatures.get(XMLConstants.FEATURE_SECURE_PROCESSING))
Review Comment:
Interesting, I see it referred to from Javadoc comments at
https://github.com/apache/commons-text/blob/5d882dca7cb01b52a184a7e36f71d0aae4b1c9ac/src/main/java/org/apache/commons/text/lookup/StringLookupFactory.java#L1630
and
https://github.com/apache/commons-text/blob/5d882dca7cb01b52a184a7e36f71d0aae4b1c9ac/src/main/java/org/apache/commons/text/lookup/StringLookupFactory.java#L1674
but _not_ from code, which tell me the comments must be left over from an
earlier implementation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
