| @@ -39,6 +39,7 @@ public class WxCryptUtil { | |||||
| try { | try { | ||||
| final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); | final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); | ||||
| factory.setExpandEntityReferences(false); | factory.setExpandEntityReferences(false); | ||||
| factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); | |||||
| return factory.newDocumentBuilder(); | return factory.newDocumentBuilder(); | ||||
| } catch (ParserConfigurationException exc) { | } catch (ParserConfigurationException exc) { | ||||
| throw new IllegalArgumentException(exc); | throw new IllegalArgumentException(exc); | ||||
| @@ -40,6 +40,7 @@ public class WxCryptUtilTest { | |||||
| DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); | DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); | ||||
| documentBuilderFactory.setExpandEntityReferences(false); | documentBuilderFactory.setExpandEntityReferences(false); | ||||
| documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); | |||||
| DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); | DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); | ||||
| Document document = documentBuilder.parse(new InputSource(new StringReader(encryptedXml))); | Document document = documentBuilder.parse(new InputSource(new StringReader(encryptedXml))); | ||||
| @@ -83,6 +84,8 @@ public class WxCryptUtilTest { | |||||
| String afterEncrpt = pc.encrypt(this.replyMsg); | String afterEncrpt = pc.encrypt(this.replyMsg); | ||||
| DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); | DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); | ||||
| dbf.setExpandEntityReferences(false); | dbf.setExpandEntityReferences(false); | ||||
| dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); | |||||
| DocumentBuilder db = dbf.newDocumentBuilder(); | DocumentBuilder db = dbf.newDocumentBuilder(); | ||||
| StringReader sr = new StringReader(afterEncrpt); | StringReader sr = new StringReader(afterEncrpt); | ||||
| InputSource is = new InputSource(sr); | InputSource is = new InputSource(sr); | ||||
| @@ -189,6 +189,7 @@ public abstract class BaseWxPayResult implements Serializable { | |||||
| try { | try { | ||||
| final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); | final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); | ||||
| factory.setExpandEntityReferences(false); | factory.setExpandEntityReferences(false); | ||||
| factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); | |||||
| this.xmlDoc = factory.newDocumentBuilder() | this.xmlDoc = factory.newDocumentBuilder() | ||||
| .parse(new ByteArrayInputStream(this.xmlString.getBytes(StandardCharsets.UTF_8))); | .parse(new ByteArrayInputStream(this.xmlString.getBytes(StandardCharsets.UTF_8))); | ||||
| return xmlDoc; | return xmlDoc; | ||||
| @@ -75,7 +75,9 @@ public class BaseWxPayResultTest { | |||||
| @Test(expectedExceptions = {RuntimeException.class}) | @Test(expectedExceptions = {RuntimeException.class}) | ||||
| public void testToMap_with_empty_xmlString() { | public void testToMap_with_empty_xmlString() { | ||||
| WxPayOrderQueryResult result = new WxPayOrderQueryResult(); | WxPayOrderQueryResult result = new WxPayOrderQueryResult(); | ||||
| result.setXmlString(" "); | |||||
| result.setXmlString( "<?xml version=\"1.0\" ?><!DOCTYPE doc " + | |||||
| "[<!ENTITY win SYSTEM \"file:///C:/Users/user/Documents/testdata2.txt\">]" + | |||||
| "><doc>&win;</doc>"); | |||||
| Map<String, String> map = result.toMap(); | Map<String, String> map = result.toMap(); | ||||
| System.out.println(map); | System.out.println(map); | ||||
| } | } | ||||