Setting secure processing to true for DOMUtils
@@ -95,12 +95,16 @@ public final class DOMUtils {
loader = getClassLoader(DOMUtils.class);
}
if (loader == null) {
- return DocumentBuilderFactory.newInstance().newDocumentBuilder();
+ DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
+ f.setNamespaceAware(true);
+ f.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ return f.newDocumentBuilder();
}
DocumentBuilder factory = DOCUMENT_BUILDERS.get(loader);
if (factory == null) {
DocumentBuilderFactory f2 = DocumentBuilderFactory.newInstance();
f2.setNamespaceAware(true);
+ f2.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory = f2.newDocumentBuilder();
DOCUMENT_BUILDERS.put(loader, factory);
}
