From d22db30166e7cb369d72be41382bb63ac8b81c52 Mon Sep 17 00:00:00 2001 From: Skylot Date: Thu, 20 Jan 2022 11:17:12 +0000 Subject: [PATCH] fix: use secure xml parser for process manifest --- .../src/main/java/jadx/core/export/ExportGradleProject.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java b/jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java index e11ebb4f961..8272bf3a032 100644 --- a/jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java +++ b/jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java @@ -8,7 +8,6 @@ import java.util.Set; import javax.xml.parsers.DocumentBuilder; -import javax.xml.parsers.DocumentBuilderFactory; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -24,6 +23,7 @@ import jadx.core.utils.exceptions.JadxRuntimeException; import jadx.core.utils.files.FileUtils; import jadx.core.xmlgen.ResContainer; +import jadx.core.xmlgen.XmlSecurity; public class ExportGradleProject { @@ -139,7 +139,7 @@ private ApplicationParams getApplicationParams(Document androidManifest, Documen private Document parseXml(String xmlContent) { try { - DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); + DocumentBuilder builder = XmlSecurity.getSecureDbf().newDocumentBuilder(); Document document = builder.parse(new InputSource(new StringReader(xmlContent))); document.getDocumentElement().normalize();