Log In
Register
Forum
Topic RSS
13:02, EEST
December 6, 2016
Offline
We transmit XML data to our OPC server via a method, containing a XmlElement parameter.
The XML data also contains a DOCTYPE, so we are getting error messages like this:
“DOCTYPE is disallowed when the feature “http://apache.org/xml/features/disallow-doctype-decl” set to true. “
How can we set “http://apache.org/xml/features/disallow-doctype-decl” to “false” ?
14:40, EEST
April 3, 2012
Offline
Hi,
This has been intentionally disabled due to prevent attacks: https://github.com/OWASP/Cheat…..et.md#java (starting from https://downloads.prosysopc.co…..sion-3-1-4)
Therefore I highly recommend not to allow that and fix the client sending the data to not send that. If you are sure data only comes from trusted sources (and that they got it from trusted sources etc.), this should allow it:
XMLFactoryCache.getDocumentBuilderFactory().setFeature(“http://apache.org/xml/features/disallow-doctype-decl”, false);
You might need to do others as well (see the owasp site linked above). Do this at the start of main before interacting with SDK code.
1 Guest(s)
