1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
From: Markus Koschany <apo@debian.org>
Date: Tue, 19 Feb 2019 19:20:16 +0100
Subject: CVE-2017-18197
Origin: https://bitbucket.org/jgraph/mxgraph2/commits/7d159ca3259b961cbb1c51b4ea42cb408c624ff1
Bug-Upstream: https://github.com/jgraph/mxgraph/issues/124
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891796
---
src/com/mxgraph/reader/mxGraphViewImageReader.java | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/src/com/mxgraph/reader/mxGraphViewImageReader.java b/src/com/mxgraph/reader/mxGraphViewImageReader.java
index 0e55710..2939cea 100644
--- a/src/com/mxgraph/reader/mxGraphViewImageReader.java
+++ b/src/com/mxgraph/reader/mxGraphViewImageReader.java
@@ -12,7 +12,6 @@ import java.io.IOException;
import java.util.Map;
import javax.xml.parsers.ParserConfigurationException;
-import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
import org.xml.sax.InputSource;
@@ -271,9 +270,13 @@ public class mxGraphViewImageReader extends mxGraphViewReader
throws ParserConfigurationException, SAXException, IOException
{
BufferedImage result = null;
- SAXParser parser = SAXParserFactory.newInstance().newSAXParser();
- XMLReader reader = parser.getXMLReader();
-
+
+ XMLReader reader = SAXParserFactory.newInstance().newSAXParser().getXMLReader();
+ reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+ reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+ reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+
reader.setContentHandler(viewReader);
reader.parse(inputSource);
|
