big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HDFS-16410. Insecure Xml parsing in OfflineEditsXmlLoader (#3854)

Browse Source 
Contributed by Ashutosh Gupta
This commit is contained in:
Ashutosh Gupta 2022-01-05 21:21:14 +05:30 committed by GitHub
parent e1d0aa9ee5
commit 43e5218a86
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/tools/offlineEditsViewer/OfflineEditsXmlLoader.java
View File

@ -86,6 +86,10 @@ public OfflineEditsXmlLoader(OfflineEditsVisitor visitor,
public void loadEdits() throws IOException { public void loadEdits() throws IOException {
try { try {
XMLReader xr = XMLReaderFactory.createXMLReader(); XMLReader xr = XMLReaderFactory.createXMLReader();
xr.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
xr.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
xr.setFeature("http://xml.org/sax/features/external-general-entities", false);
xr.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
xr.setContentHandler(this); xr.setContentHandler(this);
xr.setErrorHandler(this); xr.setErrorHandler(this);
xr.setDTDHandler(null); xr.setDTDHandler(null);