From 6e89e45cd648b5ae15b6dd794b1e4d01eaeb2545 Mon Sep 17 00:00:00 2001
From: Axel Uhl <axel.uhl@sap.com>
Date: Tue, 14 Jan 2025 14:39:18 +0100
Subject: [PATCH] XXE defense also for NOAAImporter

---
 .../src/com/sap/sailing/declination/impl/NOAAImporter.java    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/java/com.sap.sailing.declination/src/com/sap/sailing/declination/impl/NOAAImporter.java b/java/com.sap.sailing.declination/src/com/sap/sailing/declination/impl/NOAAImporter.java
index bf1ca38d54c..b9ad790390a 100755
--- a/java/com.sap.sailing.declination/src/com/sap/sailing/declination/impl/NOAAImporter.java
+++ b/java/com.sap.sailing.declination/src/com/sap/sailing/declination/impl/NOAAImporter.java
@@ -10,7 +10,6 @@ import java.util.GregorianCalendar;
 import java.util.regex.Pattern;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.w3c.dom.Document;
@@ -21,6 +20,7 @@ import com.sap.sailing.declination.Declination;
 import com.sap.sailing.domain.common.Position;
 import com.sap.sse.common.TimePoint;
 import com.sap.sse.common.impl.DegreeBearingImpl;
+import com.sap.sse.util.XmlUtil;
 
 /**
  * Imports magnetic declination data for earth from NOAA (http://www.ngdc.noaa.gov)
@@ -64,7 +64,7 @@ public class NOAAImporter extends DeclinationImporter {
         conn.setRequestProperty("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
         conn.setRequestProperty("Accept-Language", "en-US,en;q=0.8");
         conn.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.66 Safari/537.36");
-        DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+        DocumentBuilder builder = XmlUtil.getSecureDocumentBuilderFactory().newDocumentBuilder();
         final InputStream inputStream = conn.getInputStream();
         Document doc = builder.parse(inputStream);
         Element maggridresultNode = (Element) doc.getFirstChild();