Merge pull request #5952 from effective-webwork/3-6-dtd-security-issue

[3.6] Fix DTD security issue
kitodo · Feb 26, 2024 · 225fddc · 225fddc
2 parents 265c712 + 6889e23
commit 225fddc
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/Kitodo-Query-URL-Import/src/main/java/org/kitodo/queryurlimport/QueryURLImport.java b/Kitodo-Query-URL-Import/src/main/java/org/kitodo/queryurlimport/QueryURLImport.java
@@ -430,6 +430,7 @@ private Document stringToDocument(String xmlContent) throws ParserConfigurationE
             SAXException {
         DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
         documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
         return documentBuilder.parse(new InputSource(new StringReader(xmlContent)));
     }