Archives/Athou_commafeed
1
0
Fork 1
mirror of https://github.com/Athou/commafeed.git synced 2026-09-22 12:04:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

apply xml cleaning to opml files

Browse Source
This commit is contained in:
Athou
2026-06-13 11:32:57 +02:00
parent c43644861f
commit 1388fba8e4
5 changed files with 60 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
commafeed-server/src/main/java/com/commafeed/backend/feed/parser/FeedParser.java
View File

@@ -53,14 +53,14 @@ public class FeedParser {
private static final Comparator<Entry> ENTRY_COMPARATOR = Comparator.comparing(Entry::published).reversed();
private final EncodingDetector encodingDetector;
private final FeedCleaner feedCleaner;
private final XMLCleaner xmlCleaner;
public FeedParser(EncodingDetector encodingDetector, FeedCleaner feedCleaner) {
public FeedParser(EncodingDetector encodingDetector, XMLCleaner xmlCleaner) {
this.encodingDetector = encodingDetector;
this.feedCleaner = feedCleaner;
this.xmlCleaner = xmlCleaner;
// disable entity expansion limits added in JDK24+ (#1961)
// we already strip doctype declarations in FeedCleaner to prevent xxe attacks
// we already strip doctype declarations in XMLCleaner to prevent xxe attacks
// we also already limit the size of feeds we download in HttpGetter
System.setProperty(SystemProperties.JDK_XML_MAX_GENERAL_ENTITY_SIZE_LIMIT, "0");
System.setProperty(SystemProperties.JDK_XML_TOTAL_ENTITY_SIZE_LIMIT, "0");
@@ -70,7 +70,7 @@ public class FeedParser {
try {
Charset encoding = encodingDetector.getEncoding(xml);
String xmlString = feedCleaner.clean(new String(xml, encoding));
String xmlString = xmlCleaner.clean(new String(xml, encoding));
if (xmlString == null) {
throw new FeedParsingException("Input string is empty for url " + feedUrl);
}

2
commafeed-server/src/main/java/com/commafeed/backend/feed/parser/FeedCleaner.java → commafeed-server/src/main/java/com/commafeed/backend/feed/parser/XMLCleaner.java
View File

@@ -11,7 +11,7 @@ import org.apache.commons.lang3.StringUtils;
import org.jdom2.Verifier;
@Singleton
public class FeedCleaner {
public class XMLCleaner {
private static final Pattern DOCTYPE_PATTERN = Pattern.compile("<!DOCTYPE[^>]*>", Pattern.CASE_INSENSITIVE);

10
commafeed-server/src/main/java/com/commafeed/backend/opml/OPMLImporter.java
View File

@@ -10,6 +10,7 @@ import org.apache.commons.lang3.StringUtils;
import com.commafeed.backend.dao.FeedCategoryDAO;
import com.commafeed.backend.feed.FeedUtils;
import com.commafeed.backend.feed.parser.XMLCleaner;
import com.commafeed.backend.model.FeedCategory;
import com.commafeed.backend.model.User;
import com.commafeed.backend.service.FeedSubscriptionService;
@@ -26,15 +27,16 @@ import lombok.extern.slf4j.Slf4j;
@Singleton
public class OPMLImporter {
private final XMLCleaner xmlCleaner;
private final FeedCategoryDAO feedCategoryDAO;
private final FeedSubscriptionService feedSubscriptionService;
public void importOpml(User user, String xml) throws IllegalArgumentException, FeedException {
int index = xml.indexOf('<');
if (index == -1) {
throw new IllegalArgumentException("Invalid OPML: no start tag found");
xml = xmlCleaner.clean(xml);
if (xml == null) {
throw new IllegalArgumentException("Invalid OPML");
}
xml = xml.substring(index);
WireFeedInput input = new WireFeedInput();
Opml feed = (Opml) input.build(new StringReader(xml));
List<Outline> outlines = feed.getOutlines();