Missed a couple possibly unsafe XMLUtils

stanfordnlp · Oct 12, 2021 · e5bbe13 · e5bbe13 · wesley-philip · Oct 20, 2021
1 parent ab66e56
commit e5bbe13
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/src/edu/stanford/nlp/ie/machinereading/common/DomReader.java b/src/edu/stanford/nlp/ie/machinereading/common/DomReader.java
@@ -16,6 +16,8 @@
 import org.w3c.dom.NodeList;
 import org.xml.sax.SAXException;
 
+import edu.stanford.nlp.util.XMLUtils;
+
 /**
  * Generic DOM reader for an XML file
  */
@@ -127,7 +129,7 @@ public static String getAttributeValue(Node node, String attributeName) {
 	public static Document readDocument(File f) throws IOException, SAXException, ParserConfigurationException {
 		Document document = null;
 
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory factory = XMLUtils.safeDocumentBuilderFactory();
 		// factory.setValidating(true);
 		// factory.setNamespaceAware(true);
 

diff --git a/src/edu/stanford/nlp/semgraph/semgrex/ssurgeon/Ssurgeon.java b/src/edu/stanford/nlp/semgraph/semgrex/ssurgeon/Ssurgeon.java
@@ -27,6 +27,7 @@
 import edu.stanford.nlp.semgraph.semgrex.ssurgeon.pred.*;
 import edu.stanford.nlp.semgraph.semgrex.SemgrexPattern;
 import edu.stanford.nlp.util.Generics;
+import edu.stanford.nlp.util.XMLUtils;
 import edu.stanford.nlp.util.logging.Redwood;
 
 
@@ -397,7 +398,7 @@ public static String writeToString(SsurgeonPattern pattern) {
 
   private static Document createPatternXMLDoc(List<SsurgeonPattern> patterns) {
     try {
-      DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+      DocumentBuilderFactory dbf = XMLUtils.safeDocumentBuilderFactory();
       DocumentBuilder db = dbf.newDocumentBuilder();
       Document domDoc = db.newDocument();
       Element rootElt = domDoc.createElement(SsurgeonPattern.ELT_LIST_TAG);
@@ -452,7 +453,7 @@ private static Document createPatternXMLDoc(List<SsurgeonPattern> patterns) {
   @SuppressWarnings("unchecked")
   public List<SsurgeonPattern> readFromFile(File file) throws Exception {
     List<SsurgeonPattern> retList = new ArrayList<>();
-    Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(file);
+    Document doc = XMLUtils.safeDocumentBuilderFactory().newDocumentBuilder().parse(file);
 
     if (VERBOSE)
       System.out.println("Reading ssurgeon file="+file.getAbsolutePath());