Fix XML external entity vulnerability (CCSDK-3323)

Disabled XML external entity references to resolve XML external entity
vulnerability in 'SvcLogicParser.java'

Issue-ID: CCSDK-3323

Signed-off-by: Jonathan Platt <jonathan.platt@att.com>
Change-Id: Ic4a6a13e228a699abf60181a537198913900cec7

diff --git a/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java b/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java
index adec7b2..fdceaad 100644 (file)
--- a/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java
+++ b/core/sli/common/src/main/java/org/onap/ccsdk/sli/core/sli/SvcLogicParser.java
@@ -598,6 +598,9 @@ public class SvcLogicParser {
         }
 
         SAXParserFactory factory = SAXParserFactory.newInstance();
+        // To remediate XML external entity vulnerability, completely disable external entities declarations:
+        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
 
         if (schema != null) {
             factory.setNamespaceAware(true);