[xmltv] Handle possible XXE injection (openhab#15467)

XMLInputFactory: Disable property IS_SUPPORTING_EXTERNAL_ENTITIES which allows injecting external entities. Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
Pshatsillo · Sep 29, 2023 · 9596ede · 9596ede
1 parent 2ba8b6c
commit 9596ede
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/...b.binding.xmltv/src/main/java/org/openhab/binding/xmltv/internal/XmlTVHandlerFactory.java b/...b.binding.xmltv/src/main/java/org/openhab/binding/xmltv/internal/XmlTVHandlerFactory.java
@@ -54,6 +54,7 @@ public class XmlTVHandlerFactory extends BaseThingHandlerFactory {
     public XmlTVHandlerFactory(final @Reference TimeZoneProvider timeZoneProvider) throws JAXBException {
         this.timeZoneProvider = timeZoneProvider;
         this.unmarshaller = JAXBContext.newInstance(Tv.class).createUnmarshaller();
+        xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
         xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);
     }