Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HDFS-16410. Insecure Xml parsing in OfflineEditsXmlLoader (#3854) 

Contributed by Ashutosh Gupta
This commit is contained in:
Ashutosh Gupta 2022-01-05 21:21:14 +05:30 committed by Chao Sun
parent 3a82899493
commit 6b83fe4a00
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/tools/offlineEditsViewer/OfflineEditsXmlLoader.java
View File

@ -86,6 +86,10 @@ class OfflineEditsXmlLoader
public void loadEdits() throws IOException { public void loadEdits() throws IOException {
try { try {
XMLReader xr = XMLReaderFactory.createXMLReader(); XMLReader xr = XMLReaderFactory.createXMLReader();
xr.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
xr.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
xr.setFeature("http://xml.org/sax/features/external-general-entities", false);
xr.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
xr.setContentHandler(this); xr.setContentHandler(this);
xr.setErrorHandler(this); xr.setErrorHandler(this);
xr.setDTDHandler(null); xr.setDTDHandler(null);