[java] Preventing XXE when loading Firefox extensions.

See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
SeleniumHQ · Sep 29, 2019 · 7a01fd8 · 7a01fd8
1 parent 420921b
commit 7a01fd8
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/java/client/src/org/openqa/selenium/firefox/FileExtension.java b/java/client/src/org/openqa/selenium/firefox/FileExtension.java
@@ -161,6 +161,7 @@ private String readIdFromInstallRdf(File root) {
       File installRdf = new File(root, "install.rdf");
 
       DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+      factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
       factory.setNamespaceAware(true);
       factory.setExpandEntityReferences(false);
       DocumentBuilder builder = factory.newDocumentBuilder();