Fixes #281.

membrane · Oct 26, 2021 · 19de169 · 19de169
1 parent 52730dd
commit 19de169
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/core/src/main/groovy/com/predic8/schema/Include.groovy b/core/src/main/groovy/com/predic8/schema/Include.groovy
@@ -38,8 +38,11 @@ class Include extends SchemaComponent {
 
   private parseIncludedSchema(ctx){
     def resource = schema.resourceResolver.resolve(this, schema.baseDir)
-
-    def incToken = XMLInputFactory.newInstance().createXMLStreamReader(resource)
+
+    def inputFactory = XMLInputFactory.newInstance()
+    inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false)
+    inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false)
+    def incToken = inputFactory.createXMLStreamReader(resource)
     while(incToken.hasNext()) {
       if(incToken.startElement) {
         if(incToken.name.getLocalPart() =='schema'){

diff --git a/core/src/main/groovy/com/predic8/soamodel/AbstractParser.groovy b/core/src/main/groovy/com/predic8/soamodel/AbstractParser.groovy
@@ -48,6 +48,9 @@ abstract class AbstractParser{
 	}
 
 	private getToken(res) {
-		XMLInputFactory.newInstance().createXMLStreamReader(res)
+		def inputFactory = XMLInputFactory.newInstance()
+		inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false)
+		inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false)
+		inputFactory.createXMLStreamReader(res)
 	}
 }