eclipse-sailing-analytics/sailing-analytics
1
0 Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-11-02 01:00:46 +00:00
Code Activity

XXE defense also for NOAAImporter

Browse Source
This commit is contained in:
Axel Uhl committed 2025-01-14 14:39:18 +01:00
1 parent 8044fee27b
commit 6e89e45cd6
1 file changed
+2 -2
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sailing.declination/src/com/sap/sailing/declination/impl/NOAAImporter.java
+2 -2
View File
@@ -10,7 +10,6 @@ import java.util.GregorianCalendar;
import java.util.regex.Pattern;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import org.w3c.dom.Document;
@@ -21,6 +20,7 @@ import com.sap.sailing.declination.Declination;
import com.sap.sailing.domain.common.Position;
import com.sap.sse.common.TimePoint;
import com.sap.sse.common.impl.DegreeBearingImpl;
import com.sap.sse.util.XmlUtil;
/**
* Imports magnetic declination data for earth from NOAA (http://www.ngdc.noaa.gov)
@@ -64,7 +64,7 @@ public class NOAAImporter extends DeclinationImporter {
conn.setRequestProperty("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
conn.setRequestProperty("Accept-Language", "en-US,en;q=0.8");
conn.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.66 Safari/537.36");
DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
DocumentBuilder builder = XmlUtil.getSecureDocumentBuilderFactory().newDocumentBuilder();
final InputStream inputStream = conn.getInputStream();
Document doc = builder.parse(inputStream);
Element maggridresultNode = (Element) doc.getFirstChild();