hz/java-servers
1
0
Fork 0
mirror of https://codeup.aliyun.com/67762337eccfc218f6110e0e/per-boe/java-servers.git synced 2025-12-20 00:06:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

XML外部实体注入

Browse Source
This commit is contained in:
yang
2024-08-26 19:26:34 +08:00
parent 376c47befc
commit e16b890a8d
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
modules/boe-module-scorm/src/main/java/com/xboe/module/scorm/cam/load/ContentPackageGenerator.java
View File

@@ -1,6 +1,8 @@
package com.xboe.module.scorm.cam.load;
import java.io.File;
import java.io.IOException;
import java.io.StringReader;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@@ -85,6 +87,9 @@ import com.xboe.module.scorm.cam.model.datatype.NonNegativeInteger;
import com.xboe.module.scorm.cam.model.datatype.Token;
import com.xboe.module.scorm.cam.model.datatype.VCard;
import com.xboe.module.scorm.common.CommonUtils;
import org.xml.sax.EntityResolver;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
@Slf4j
public class ContentPackageGenerator {
@@ -145,6 +150,15 @@ public class ContentPackageGenerator {
Document manifestXml;
try {
SAXReader reader = new SAXReader();
reader.setEntityResolver(new EntityResolver() {
@Override
public InputSource resolveEntity(String publicId, String systemId) throws SAXException, IOException {
// 总是返回空的InputSource来忽略外部实体
return new InputSource(new StringReader(""));
}
});
manifestXml = reader.read(manifestXmlFile);
} catch (DocumentException e) {