From ae3ad3745cf5fb3bced8a8958de42e98ddf7b3e6 Mon Sep 17 00:00:00 2001
From: Athou <jeremiepanzer@gmail.com>
Date: Mon, 3 Aug 2026 09:15:23 +0200
Subject: [PATCH] move global System.setProperty calls in CommaFeedApplication

---
 .../src/main/java/com/commafeed/CommaFeedApplication.java | 8 ++++++++
 .../com/commafeed/backend/feed/parser/FeedParser.java     | 7 -------
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java b/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
index 1ac3f535..7a137a84 100644
--- a/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
+++ b/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
@@ -14,6 +14,8 @@ import jakarta.inject.Singleton;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
+import org.apache.commons.lang3.SystemProperties;
+
 @Slf4j
 @Singleton
 @RequiredArgsConstructor
@@ -26,6 +28,12 @@ public class CommaFeedApplication {
     public void start(@Observes StartupEvent ev) {
         log.info("starting up...");
 
+        // disable entity expansion limits added in JDK24+ (#1961)
+        // we already strip doctype declarations in XMLCleaner to prevent xxe attacks
+        // we also already limit the size of feeds we download in HttpGetter
+        System.setProperty(SystemProperties.JDK_XML_MAX_GENERAL_ENTITY_SIZE_LIMIT, "0");
+        System.setProperty(SystemProperties.JDK_XML_TOTAL_ENTITY_SIZE_LIMIT, "0");
+
         PasswordConstraintValidator.setMinimumPasswordLength(
                 config.users().minimumPasswordLength());
 
diff --git a/commafeed-server/src/main/java/com/commafeed/backend/feed/parser/FeedParser.java b/commafeed-server/src/main/java/com/commafeed/backend/feed/parser/FeedParser.java
index 33a25251..ad22118c 100644
--- a/commafeed-server/src/main/java/com/commafeed/backend/feed/parser/FeedParser.java
+++ b/commafeed-server/src/main/java/com/commafeed/backend/feed/parser/FeedParser.java
@@ -23,7 +23,6 @@ import jakarta.inject.Singleton;
 
 import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.StringUtils;
-import org.apache.commons.lang3.SystemProperties;
 import org.apache.commons.math3.stat.descriptive.SummaryStatistics;
 import org.jdom2.Element;
 import org.jdom2.Namespace;
@@ -58,12 +57,6 @@ public class FeedParser {
     public FeedParser(EncodingDetector encodingDetector, XMLCleaner xmlCleaner) {
         this.encodingDetector = encodingDetector;
         this.xmlCleaner = xmlCleaner;
-
-        // disable entity expansion limits added in JDK24+ (#1961)
-        // we already strip doctype declarations in XMLCleaner to prevent xxe attacks
-        // we also already limit the size of feeds we download in HttpGetter
-        System.setProperty(SystemProperties.JDK_XML_MAX_GENERAL_ENTITY_SIZE_LIMIT, "0");
-        System.setProperty(SystemProperties.JDK_XML_TOTAL_ENTITY_SIZE_LIMIT, "0");
     }
 
     public FeedParserResult parse(String feedUrl, byte[] xml) throws FeedParsingException {