fix: use secure xml parser for process manifest

skylot · Jan 20, 2022 · d22db30 · d22db30
1 parent 6db61e7
commit d22db30
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java b/jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java
@@ -8,7 +8,6 @@
 import java.util.Set;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -24,6 +23,7 @@
 import jadx.core.utils.exceptions.JadxRuntimeException;
 import jadx.core.utils.files.FileUtils;
 import jadx.core.xmlgen.ResContainer;
+import jadx.core.xmlgen.XmlSecurity;
 
 public class ExportGradleProject {
 
@@ -139,7 +139,7 @@ private ApplicationParams getApplicationParams(Document androidManifest, Documen
 
 	private Document parseXml(String xmlContent) {
 		try {
-			DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			DocumentBuilder builder = XmlSecurity.getSecureDbf().newDocumentBuilder();
 			Document document = builder.parse(new InputSource(new StringReader(xmlContent)));
 
 			document.getDocumentElement().normalize();