@@ -39,6 +39,7 @@ public class WxCryptUtil { | |||||
try { | try { | ||||
final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); | final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); | ||||
factory.setExpandEntityReferences(false); | factory.setExpandEntityReferences(false); | ||||
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); | |||||
return factory.newDocumentBuilder(); | return factory.newDocumentBuilder(); | ||||
} catch (ParserConfigurationException exc) { | } catch (ParserConfigurationException exc) { | ||||
throw new IllegalArgumentException(exc); | throw new IllegalArgumentException(exc); | ||||
@@ -40,6 +40,7 @@ public class WxCryptUtilTest { | |||||
DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); | DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); | ||||
documentBuilderFactory.setExpandEntityReferences(false); | documentBuilderFactory.setExpandEntityReferences(false); | ||||
documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); | |||||
DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); | DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); | ||||
Document document = documentBuilder.parse(new InputSource(new StringReader(encryptedXml))); | Document document = documentBuilder.parse(new InputSource(new StringReader(encryptedXml))); | ||||
@@ -83,6 +84,8 @@ public class WxCryptUtilTest { | |||||
String afterEncrpt = pc.encrypt(this.replyMsg); | String afterEncrpt = pc.encrypt(this.replyMsg); | ||||
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); | DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); | ||||
dbf.setExpandEntityReferences(false); | dbf.setExpandEntityReferences(false); | ||||
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); | |||||
DocumentBuilder db = dbf.newDocumentBuilder(); | DocumentBuilder db = dbf.newDocumentBuilder(); | ||||
StringReader sr = new StringReader(afterEncrpt); | StringReader sr = new StringReader(afterEncrpt); | ||||
InputSource is = new InputSource(sr); | InputSource is = new InputSource(sr); | ||||
@@ -189,6 +189,7 @@ public abstract class BaseWxPayResult implements Serializable { | |||||
try { | try { | ||||
final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); | final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); | ||||
factory.setExpandEntityReferences(false); | factory.setExpandEntityReferences(false); | ||||
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); | |||||
this.xmlDoc = factory.newDocumentBuilder() | this.xmlDoc = factory.newDocumentBuilder() | ||||
.parse(new ByteArrayInputStream(this.xmlString.getBytes(StandardCharsets.UTF_8))); | .parse(new ByteArrayInputStream(this.xmlString.getBytes(StandardCharsets.UTF_8))); | ||||
return xmlDoc; | return xmlDoc; | ||||
@@ -75,7 +75,9 @@ public class BaseWxPayResultTest { | |||||
@Test(expectedExceptions = {RuntimeException.class}) | @Test(expectedExceptions = {RuntimeException.class}) | ||||
public void testToMap_with_empty_xmlString() { | public void testToMap_with_empty_xmlString() { | ||||
WxPayOrderQueryResult result = new WxPayOrderQueryResult(); | WxPayOrderQueryResult result = new WxPayOrderQueryResult(); | ||||
result.setXmlString(" "); | |||||
result.setXmlString( "<?xml version=\"1.0\" ?><!DOCTYPE doc " + | |||||
"[<!ENTITY win SYSTEM \"file:///C:/Users/user/Documents/testdata2.txt\">]" + | |||||
"><doc>&win;</doc>"); | |||||
Map<String, String> map = result.toMap(); | Map<String, String> map = result.toMap(); | ||||
System.out.println(map); | System.out.println(map); | ||||
} | } | ||||