[java] Preventing XXE when loading Firefox extensions.
See
@@ -161,6 +161,7 @@ private String readIdFromInstallRdf(File root) {
File installRdf = new File(root, "install.rdf");
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+ factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setNamespaceAware(true);
factory.setExpandEntityReferences(false);
DocumentBuilder builder = factory.newDocumentBuilder();
