From e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Brunner?= <stephane.brunner@camptocamp.com>
Date: Thu, 2 Jul 2020 16:25:50 +0200
Subject: [PATCH] See:
 https://github.com/mapfish/mapfish-print/security/code-scanning/3?query=ref%3Arefs%2Fheads%2Fmaster

---
 .../main/java/org/mapfish/print/map/style/SLDParserPlugin.java   | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/src/main/java/org/mapfish/print/map/style/SLDParserPlugin.java b/core/src/main/java/org/mapfish/print/map/style/SLDParserPlugin.java
index fc27e2a518..bab2d95eef 100644
--- a/core/src/main/java/org/mapfish/print/map/style/SLDParserPlugin.java
+++ b/core/src/main/java/org/mapfish/print/map/style/SLDParserPlugin.java
@@ -94,6 +94,7 @@ private Optional<Style> tryLoadSLD(
             // by setting a custom error handler.
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             dbf.setNamespaceAware(true);
+            dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
             DocumentBuilder db = dbf.newDocumentBuilder();
             db.setErrorHandler(new ErrorHandler());
             db.parse(new ByteArrayInputStream(bytes));