BATIK-1284: Dont load DTDs in NodePickerPanel

git-svn-id: https://svn.apache.org/repos/asf/xmlgraphics/batik/trunk@1878396 13f79535-47bb-0310-9956-ffa450edef68
apache · Jun 2, 2020 · 0ef5b66 · 0ef5b66
1 parent f16e092
commit 0ef5b66
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/batik-svgbrowser/src/main/java/org/apache/batik/apps/svgbrowser/NodePickerPanel.java b/batik-svgbrowser/src/main/java/org/apache/batik/apps/svgbrowser/NodePickerPanel.java
@@ -847,8 +847,10 @@ private Element parseXml(String xmlString) {
         Document doc = null;
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         try {
-            javax.xml.parsers.DocumentBuilder parser = factory
-                    .newDocumentBuilder();
+            factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+            factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            javax.xml.parsers.DocumentBuilder parser = factory.newDocumentBuilder();
             parser.setErrorHandler(new ErrorHandler() {
                 public void error(SAXParseException exception)
                         throws SAXException {