JoeKung/print-calculator
1
1
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(back-end): fix security issue
Some checks failed
Build and Deploy / test-backend (push) Successful in 25s
Details
PR Checks / prettier-autofix (pull_request) Successful in 8s
Details
PR Checks / security-sast (pull_request) Failing after 29s
Details
Build and Deploy / test-frontend (push) Successful in 1m5s
Details
PR Checks / test-backend (pull_request) Successful in 27s
Details
Build and Deploy / build-and-push (push) Successful in 37s
Details
PR Checks / test-frontend (pull_request) Successful in 1m5s
Details
Build and Deploy / deploy (push) Successful in 12s
Details

Browse Source
This commit is contained in:
Joe Küng
2026-03-03 18:19:15 +01:00
parent 476dc5b2ce
commit f5cdaf51cb
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
backend/src/main/java/com/printcalculator/service/SlicerService.java
View File

@@ -639,9 +639,9 @@ public class SlicerService {
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
disableIfSupported(dbf, "http://apache.org/xml/features/disallow-doctype-decl");
disableIfSupported(dbf, "http://xml.org/sax/features/external-general-entities");
disableIfSupported(dbf, "http://xml.org/sax/features/external-parameter-entities");
setFeatureIfSupported(dbf, "http://apache.org/xml/features/disallow-doctype-decl", true);
setFeatureIfSupported(dbf, "http://xml.org/sax/features/external-general-entities", false);
setFeatureIfSupported(dbf, "http://xml.org/sax/features/external-parameter-entities", false);
dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);
@@ -650,9 +650,9 @@ public class SlicerService {
}
}
private void disableIfSupported(DocumentBuilderFactory dbf, String feature) {
private void setFeatureIfSupported(DocumentBuilderFactory dbf, String feature, boolean enabled) {
try {
dbf.setFeature(feature, false);
dbf.setFeature(feature, enabled);
} catch (Exception ignored) {
// Best-effort hardening.
}