add fix

nahsra · nahsra · commit ce971b3a4415 · 2024-06-21T16:42:21.000-04:00
diff --git a/src/main/java/com/acme/XXEVulnFixed.java b/src/main/java/com/acme/XXEVulnFixed.java
@@ -89,6 +89,8 @@ public static Document withDomButDisabled(String xml)
   public static void withReaderFactory(String xml)
       throws IOException, SAXException {
     XMLReader reader = XMLReaderFactory.createXMLReader();
+    reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
     reader.parse(new InputSource(new StringReader(xml)));
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -89,6 +89,8 @@ public static Document withDomButDisabled(String xml)`
`89`	`89`	`public static void withReaderFactory(String xml)`
`90`	`90`	`throws IOException, SAXException {`
`91`	`91`	`XMLReader reader = XMLReaderFactory.createXMLReader();`
	`92`	`+ reader.setFeature("http://xml.org/sax/features/external-general-entities", false);`
	`93`	`+ reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);`
`92`	`94`	`reader.parse(new InputSource(new StringReader(xml)));`
`93`	`95`	`}`
`94`	`96`	`}`