Fix xml external entity vulnerability

2019-12-13 01:07:01 +08:00 · 2019-12-13 01:07:01 +08:00 · 568e48733f
parent 2056f528fd
commit 568e48733f
1 changed files with 1 additions and 0 deletions
--- a/src/main/java/run/halo/app/utils/WordPressMigrateUtils.java
+++ b/src/main/java/run/halo/app/utils/WordPressMigrateUtils.java
@ -43,6 +43,7 @@ public class WordPressMigrateUtils {
        try {
            SAXReader saxReader = new SAXReader();
            Document document = saxReader.read(fileInputStream);
+            saxReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
            return document.getRootElement();
        } catch (Exception e) {
            throw new RuntimeException("can not get root element");