Merge pull request #3251 from mybatis/autofix/alert-6-2d7812d9b9

Fix code scanning alert no. 6: Resolving XML external entity in user-controlled data
mybatis · Sep 26, 2024 · 7e8d836 · 7e8d836
2 parents 2967694 + 650146b
commit 7e8d836
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/main/java/org/apache/ibatis/parsing/XPathParser.java b/src/main/java/org/apache/ibatis/parsing/XPathParser.java
@@ -237,7 +237,7 @@ private Document createDocument(InputSource inputSource) {
       factory.setIgnoringComments(true);
       factory.setIgnoringElementContentWhitespace(false);
       factory.setCoalescing(false);
-      factory.setExpandEntityReferences(true);
+      factory.setExpandEntityReferences(false);
 
       DocumentBuilder builder = factory.newDocumentBuilder();
       builder.setEntityResolver(entityResolver);