分类： XML

DocumentBuilderFactory 的Forify 问题 : XML External Entity Injection及解决

Posted on by admin
参考代码 


DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();

documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);

documentBuilderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

documentBuilderFactory.setXIncludeAware(false);

documentBuilderFactory.setExpandEntityReferences(false);

……