Archives/Athou_commafeed
1
0
Fork 1
mirror of https://github.com/Athou/commafeed.git synced 2026-09-24 13:05:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

apply xml cleaning to opml files

Browse Source
This commit is contained in:
Athou
2026-06-13 11:32:57 +02:00
parent c43644861f
commit 1388fba8e4
5 changed files with 60 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
commafeed-server/src/main/java/com/commafeed/backend/feed/parser/FeedParser.java
View File

@@ -53,14 +53,14 @@ public class FeedParser {
private static final Comparator<Entry> ENTRY_COMPARATOR = Comparator.comparing(Entry::published).reversed();
private final EncodingDetector encodingDetector;
private final FeedCleaner feedCleaner;
private final XMLCleaner xmlCleaner;
public FeedParser(EncodingDetector encodingDetector, FeedCleaner feedCleaner) {
public FeedParser(EncodingDetector encodingDetector, XMLCleaner xmlCleaner) {
this.encodingDetector = encodingDetector;
this.feedCleaner = feedCleaner;
this.xmlCleaner = xmlCleaner;
// disable entity expansion limits added in JDK24+ (#1961)
// we already strip doctype declarations in FeedCleaner to prevent xxe attacks
// we already strip doctype declarations in XMLCleaner to prevent xxe attacks
// we also already limit the size of feeds we download in HttpGetter
System.setProperty(SystemProperties.JDK_XML_MAX_GENERAL_ENTITY_SIZE_LIMIT, "0");
System.setProperty(SystemProperties.JDK_XML_TOTAL_ENTITY_SIZE_LIMIT, "0");
@@ -70,7 +70,7 @@ public class FeedParser {
try {
Charset encoding = encodingDetector.getEncoding(xml);
String xmlString = feedCleaner.clean(new String(xml, encoding));
String xmlString = xmlCleaner.clean(new String(xml, encoding));
if (xmlString == null) {
throw new FeedParsingException("Input string is empty for url " + feedUrl);
}

2
commafeed-server/src/main/java/com/commafeed/backend/feed/parser/FeedCleaner.java → commafeed-server/src/main/java/com/commafeed/backend/feed/parser/XMLCleaner.java
View File

@@ -11,7 +11,7 @@ import org.apache.commons.lang3.StringUtils;
import org.jdom2.Verifier;
@Singleton
public class FeedCleaner {
public class XMLCleaner {
private static final Pattern DOCTYPE_PATTERN = Pattern.compile("<!DOCTYPE[^>]*>", Pattern.CASE_INSENSITIVE);