robertlazarski commented on PR #1221:
URL:
https://github.com/apache/axis-axis2-java-core/pull/1221#issuecomment-4886981721
Merged — thanks, and welcome as a contributor! 🎉
The fix is correct and lands in exactly the right spot. setContent(Source)
was the one SAAJ parse path that built its own XMLInputFactory and created
the reader directly, so it bypassed the DTD guard that Axiom otherwise
applies to SOAP parsing (StAXParserConfiguration.SOAP rejects any DOCTYPE).
Disabling SUPPORT_DTD here closes that gap at the root, and
IS_SUPPORTING_EXTERNAL_ENTITIES=false is good defense-in-depth on top. I
confirmed the inbound-message paths (MessageFactory.createMessage(...,
InputStream) and the MTOM branch) already route through Axiom's hardened
builder, so this was the right — and only — path that needed attention.
This also can't break a legitimate caller: SOAP 1.1 and 1.2 both prohibit
DTDs in the envelope, so a spec-compliant message never carries a DOCTYPE.
The test is well done too — pointing a SYSTEM entity at a temp file and
asserting the marker never appears in the serialized message is the right
check, and accepting either "rejected with an exception" or "not expanded"
as a pass is exactly correct.
Appreciate the clear write-up on the PR. Thanks again!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
