Fix XML schema vulnerability

stanfordnlp · Jan 16, 2022 · 1940ffb · 1940ffb
1 parent 820192c
commit 1940ffb
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/src/edu/stanford/nlp/util/XMLUtils.java b/src/edu/stanford/nlp/util/XMLUtils.java
@@ -302,6 +302,7 @@ public static DocumentBuilder getValidatingXmlParser(File schemaFile) {
       DocumentBuilderFactory dbf = safeDocumentBuilderFactory();
 
       SchemaFactory factory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+      factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
       Schema schema = factory.newSchema(schemaFile);
       dbf.setSchema(schema);