Add more xxe preventions

1 files changed, 17 insertions, 7 deletions

diff --git a/config-model/src/main/java/com/yahoo/config/model/builder/xml/XmlHelper.java b/config-model/src/main/java/com/yahoo/config/model/builder/xml/XmlHelper.java
index 220d6bbb768..9a9a7733c96 100644
--- a/config-model/src/main/java/com/yahoo/config/model/builder/xml/XmlHelper.java
+++ b/config-model/src/main/java/com/yahoo/config/model/builder/xml/XmlHelper.java
@@ -36,13 +36,7 @@ public final class XmlHelper {
 
     private static final String idReference = "idref";
     // Access to this needs to be synchronized (as it is in getDocumentBuilder() below)
-    public static final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-
-    static {
-        XmlHelper.factory.setNamespaceAware(true);
-        // if use jdom and jaxen this will fail badly:
-        XmlHelper.factory.setXIncludeAware(true);
-    }
+    public static final DocumentBuilderFactory factory = createDocumentBuilderFactory();
 
     private XmlHelper() {}
 
@@ -184,4 +178,20 @@ public final class XmlHelper {
 
     }
 
+    private static DocumentBuilderFactory createDocumentBuilderFactory() {
+        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        factory.setNamespaceAware(true);
+        factory.setXIncludeAware(false);
+
+        try {
+            // XXE prevention
+            factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+            factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            return factory;
+        } catch (ParserConfigurationException e) {
+            log.log(Level.SEVERE, "Could not initialize XML parser", e);
+            throw new RuntimeException(e);
+        }
+    }
 }