Add more xxe preventions

1 files changed, 19 insertions, 10 deletions

diff --git a/config-application-package/src/main/java/com/yahoo/config/application/Xml.java b/config-application-package/src/main/java/com/yahoo/config/application/Xml.java
index dc5ae998586..2cc5e1ac4e2 100644
--- a/config-application-package/src/main/java/com/yahoo/config/application/Xml.java
+++ b/config-application-package/src/main/java/com/yahoo/config/application/Xml.java
@@ -35,12 +35,7 @@ public class Xml {
     private static final Logger log = Logger.getLogger(Xml.class.getPackage().toString());
 
     // Access to this needs to be synchronized (as it is in getDocumentBuilder() below)
-    private static final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-
-    static {
-        factory.setNamespaceAware(true);
-        factory.setXIncludeAware(false);
-    }
+    private static final DocumentBuilderFactory factory = createDocumentBuilderFactory();
 
     public static Document getDocument(Reader reader) {
         Document doc;
@@ -52,6 +47,23 @@ public class Xml {
         return doc;
     }
 
+    private static DocumentBuilderFactory createDocumentBuilderFactory() {
+        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        factory.setNamespaceAware(true);
+        factory.setXIncludeAware(false);
+
+        try {
+            // XXE prevention
+            factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+            factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            return factory;
+        } catch (ParserConfigurationException e) {
+            log.log(Level.SEVERE, "Could not initialize XML parser", e);
+            throw new RuntimeException(e);
+        }
+    }
+
     /**
      * Creates a new XML document builder.
      *
@@ -67,10 +79,7 @@ public class Xml {
     }
 
     static DocumentBuilder getPreprocessDocumentBuilder() throws ParserConfigurationException {
-        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-        factory.setFeature("http://xml.org/sax/features/external-general-entities", false); // XXE prevention
-        factory.setNamespaceAware(true);
-        factory.setXIncludeAware(false);
+        DocumentBuilderFactory factory = createDocumentBuilderFactory();
         factory.setValidating(false);
         return factory.newDocumentBuilder();
     }