Fix DTD security issue (kitodo#5940)

henning-gerhardt · Feb 23, 2024 · e5e6d13 · e5e6d13
1 parent 2969b18
commit e5e6d13
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/Kitodo-Query-URL-Import/src/main/java/org/kitodo/queryurlimport/QueryURLImport.java b/Kitodo-Query-URL-Import/src/main/java/org/kitodo/queryurlimport/QueryURLImport.java
@@ -430,6 +430,7 @@ private Document stringToDocument(String xmlContent) throws ParserConfigurationE
             SAXException {
         DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
         documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
         return documentBuilder.parse(new InputSource(new StringReader(xmlContent)));
     }