Fix #190

FasterXML · Apr 15, 2016 · f0f19a4 · f0f19a4
1 parent c2ccf8d
commit f0f19a4
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/release-notes/VERSION b/release-notes/VERSION
@@ -4,6 +4,11 @@ Project: jackson-dataformat-xml
 = Releases
 ------------------------------------------------------------------------
 
+2.7.4 (not yet released)
+
+#190: Ensure that defaults for `XMLInputFactory` have expansion of external
+    parsed general entities disabled
+
 2.7.3 (16-Mar-2016)
 
 No changes since 2.7.2

diff --git a/src/main/java/com/fasterxml/jackson/dataformat/xml/XmlFactory.java b/src/main/java/com/fasterxml/jackson/dataformat/xml/XmlFactory.java
@@ -111,6 +111,8 @@ protected XmlFactory(ObjectCodec oc, int xpFeatures, int xgFeatures,
         _cfgNameForTextElement = nameForTextElem;
         if (xmlIn == null) {
             xmlIn = XMLInputFactory.newInstance();
+            // as per [dataformat-xml#190], disable external entity expansion by default
+            xmlIn.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
         }
         if (xmlOut == null) {
             xmlOut = XMLOutputFactory.newInstance();