Merge pull request #283 from arunvenmany-ibm/sast_issue_fix_1.0

adding property to xmlreader of lemminx
OpenLiberty · Aug 6, 2024 · 7f84923 · 7f84923
2 parents 9c600b3 + 031272a
commit 7f84923
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/lemminx-liberty/src/main/java/io/openliberty/tools/langserver/lemminx/util/DocumentUtil.java b/lemminx-liberty/src/main/java/io/openliberty/tools/langserver/lemminx/util/DocumentUtil.java
@@ -87,6 +87,8 @@ public static void writeDocToXmlFile(Document doc, File inputFile) throws Except
     private static TransformerFactory getTransformerFactory() throws TransformerConfigurationException {
         TransformerFactory transformerFactory = TransformerFactory.newInstance();
         transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+        transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
         return transformerFactory;
     }
 

diff --git a/lemminx-liberty/src/main/java/io/openliberty/tools/langserver/lemminx/util/XmlReader.java b/lemminx-liberty/src/main/java/io/openliberty/tools/langserver/lemminx/util/XmlReader.java
@@ -86,7 +86,7 @@ public static boolean hasServerRoot(File xmlFile) {
     }
 
     private static XMLInputFactory getXmlInputFactory() {
-        XMLInputFactory factory = XMLInputFactory.newInstance();
+        XMLInputFactory factory = XMLInputFactory.newFactory();
         try {
             factory.setProperty(XMLInputFactory.IS_VALIDATING, Boolean.FALSE);
             factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
@@ -114,7 +114,7 @@ public static Map<String, String> getElementValues(Path file, Set<String> elemen
         }
         Map<String, String> returnValues = new HashMap<String, String> ();
 
-        XMLInputFactory factory = XMLInputFactory.newInstance();
+        XMLInputFactory factory = getXmlInputFactory();
         XMLEventReader reader = null;
         try {
             reader = factory.createXMLEventReader(new FileInputStream(file.toFile()));