Apache
/
activemq
mirror of https://github.com/apache/activemq.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

This closes #321

This commit is contained in:
Jean-Baptiste Onofré 2018-11-22 14:41:08 +01:00
parent 8cc0c5ad6c a87b61e8be
commit 112c4e602f
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
activemq-client/src/main/java/org/apache/activemq/filter/XPathExpression.java
View File

@ -25,6 +25,7 @@ import java.util.Map;
import java.util.Properties;
import javax.jms.JMSException;
import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
@ -59,6 +60,7 @@ public final class XPathExpression implements BooleanExpression {
builderFactory.setIgnoringComments(true);
try {
// set some reasonable defaults
builderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
builderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
builderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
builderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

6
activemq-console/src/main/java/org/apache/activemq/console/command/CreateCommand.java
View File

@ -20,6 +20,7 @@ import org.w3c.dom.Attr;
import org.w3c.dom.Element;
import org.xml.sax.SAXException;
import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
@ -158,7 +159,10 @@ public class CreateCommand extends AbstractCommand {
File dest = new File(targetBase, DEFAULT_TARGET_ACTIVEMQ_CONF);
context.print("Copying from: " + src.getCanonicalPath() + "\n to: " + dest.getCanonicalPath());
DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
DocumentBuilder builder = dbf.newDocumentBuilder();
Element docElem = builder.parse(src).getDocumentElement();
XPath xpath = XPathFactory.newInstance().newXPath();

3
activemq-runtime-config/src/main/java/org/apache/activemq/plugin/RuntimeConfigurationBroker.java
View File

@ -180,6 +180,9 @@ public class RuntimeConfigurationBroker extends AbstractRuntimeConfigurationBrok
// skip beans and pull out the broker node to validate
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
DocumentBuilder db = dbf.newDocumentBuilder();
Document doc = db.parse(configToMonitor.getInputStream());
Node brokerRootNode = doc.getElementsByTagNameNS("*","broker").item(0);