EWS: disable IS_SUPPORTING_EXTERNAL_ENTITIES to fix xml parsing secur…

…ity warning git-svn-id: https://svn.code.sf.net/p/davmail/code/trunk@3518 3d1905a2-6b24-0410-a738-b14d5a86fcbd
mguessan · Mar 10, 2024 · 070a0c3 · 070a0c3
1 parent 688bfda
commit 070a0c3
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/src/java/davmail/exchange/XMLStreamUtil.java b/src/java/davmail/exchange/XMLStreamUtil.java
@@ -50,6 +50,7 @@ public static XMLInputFactory getXmlInputFactory() {
         inputFactory.setProperty(XMLInputFactory.IS_COALESCING, Boolean.TRUE);
         inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.TRUE);
         inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
+        inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
         // Woodstox 5.2.0 or later
         if (inputFactory.isPropertySupported("com.ctc.wstx.allowXml11EscapedCharsInXml10")) {
             inputFactory.setProperty("com.ctc.wstx.allowXml11EscapedCharsInXml10", Boolean.TRUE);