Disable external DTDs in the LogSrviceLog4j2XmlImpl
@@ -125,6 +125,13 @@ public class LogServiceLog4j2XmlImpl implements LogServiceInternal {
try (OutputStream os = Files.newOutputStream(path, StandardOpenOption.WRITE, StandardOpenOption.TRUNCATE_EXISTING)) {
TransformerFactory tFactory = TransformerFactory.newInstance();
tFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ try {
+ tFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ tFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ } catch (IllegalArgumentException e) {
+ // ignore
+ }
+
Transformer transformer = tFactory.newTransformer();
transformer.transform(new DOMSource(doc), new StreamResult(os));
}
