[xmltv] Handle possible XXE injection (openhab#15467)

XMLInputFactory: Disable property IS_SUPPORTING_EXTERNAL_ENTITIES which allows injecting external entities. Signed-off-by: Holger Friedrich <mail@holger-friedrich.de> Signed-off-by: querdenker2k <querdenker2k@gmx.de>
querdenker2k · Oct 29, 2023 · bf117eb · bf117eb
1 parent befda56
commit bf117eb
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/...b.binding.xmltv/src/main/java/org/openhab/binding/xmltv/internal/XmlTVHandlerFactory.java b/...b.binding.xmltv/src/main/java/org/openhab/binding/xmltv/internal/XmlTVHandlerFactory.java
@@ -54,6 +54,7 @@ public class XmlTVHandlerFactory extends BaseThingHandlerFactory {
     public XmlTVHandlerFactory(final @Reference TimeZoneProvider timeZoneProvider) throws JAXBException {
         this.timeZoneProvider = timeZoneProvider;
         this.unmarshaller = JAXBContext.newInstance(Tv.class).createUnmarshaller();
+        xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
         xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);
     }