[OpenNMS/opennms] 043fac: NMS-20206: Fix XXE in XML collector
Chandra Gorantla via opennms-cvs <[email protected]>
| Newsgroups | gmane.network.opennms.cvs |
|---|---|
| Message-ID | <OpenNMS/opennms/push/refs/heads/cg/jira/NMS-20206/[email protected]> |
Branch: refs/heads/cg/jira/NMS-20206
Home: https://github.com/OpenNMS/opennms
Commit: 043fac58d7d0eb34e08fb57236be9efbec47b799
https://github.com/OpenNMS/opennms/commit/043fac58d7d0eb34e08fb57236be9efbec47b799
Author: Chandra Gorantla <[email protected]>
Date: 2026-08-12 (Wed, 12 Aug 2026)
Changed paths:
M protocols/xml/src/main/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandler.java
M protocols/xml/src/test/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandlerTest.java
Log Message:
-----------
NMS-20206: Fix XXE in XML collector
Disable external entity/DTD resolution in AbstractXmlCollectionHandler's
DocumentBuilderFactory and TransformerFactory so collected XML cannot read local
files or trigger out-of-band requests. Avoids disallow-doctype-decl to keep
pre-parse-html working. Adds regression tests.
To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list
To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs