|
|
@@ -223,7 +223,7 @@ public final class XMLHelper { |
|
|
|
trySet(factory::setFeature, FEATURE_SECURE_PROCESSING, true); |
|
|
|
trySet(factory::setAttribute, ACCESS_EXTERNAL_DTD, ""); |
|
|
|
trySet(factory::setAttribute, ACCESS_EXTERNAL_STYLESHEET, ""); |
|
|
|
trySet(factory::setAttribute, ACCESS_EXTERNAL_SCHEMA, ""); |
|
|
|
quietSet(factory::setAttribute, ACCESS_EXTERNAL_SCHEMA, ""); |
|
|
|
return factory; |
|
|
|
} |
|
|
|
|
|
|
@@ -292,6 +292,16 @@ public final class XMLHelper { |
|
|
|
return false; |
|
|
|
} |
|
|
|
|
|
|
|
private static boolean quietSet(SecurityProperty property, String name, Object value) { |
|
|
|
try { |
|
|
|
property.accept(name, value); |
|
|
|
return true; |
|
|
|
} catch (Exception|Error e) { |
|
|
|
// ok to ignore |
|
|
|
} |
|
|
|
return false; |
|
|
|
} |
|
|
|
|
|
|
|
private static void logThrowable(Throwable t, String message, String name) { |
|
|
|
if (System.currentTimeMillis() > lastLog + TimeUnit.MINUTES.toMillis(5)) { |
|
|
|
LOG.atWarn().withThrowable(t).log("{} [log suppressed for 5 minutes]{}", message, name); |