Archives/Athou_commafeed
1
0
Fork 1
mirror of https://github.com/Athou/commafeed.git synced 2026-09-22 03:54:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

move global System.setProperty calls in CommaFeedApplication

Browse Source
This commit is contained in:
Athou
2026-08-03 09:15:23 +02:00
parent 2e1e5257b4
commit ae3ad3745c
2 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
View File

@@ -14,6 +14,8 @@ import jakarta.inject.Singleton;
import lombok.RequiredArgsConstructor; import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.SystemProperties;
@Slf4j @Slf4j
@Singleton @Singleton
@RequiredArgsConstructor @RequiredArgsConstructor
@@ -26,6 +28,12 @@ public class CommaFeedApplication {
public void start(@Observes StartupEvent ev) { public void start(@Observes StartupEvent ev) {
log.info("starting up..."); log.info("starting up...");
// disable entity expansion limits added in JDK24+ (#1961)
// we already strip doctype declarations in XMLCleaner to prevent xxe attacks
// we also already limit the size of feeds we download in HttpGetter
System.setProperty(SystemProperties.JDK_XML_MAX_GENERAL_ENTITY_SIZE_LIMIT, "0");
System.setProperty(SystemProperties.JDK_XML_TOTAL_ENTITY_SIZE_LIMIT, "0");
PasswordConstraintValidator.setMinimumPasswordLength( PasswordConstraintValidator.setMinimumPasswordLength(
config.users().minimumPasswordLength()); config.users().minimumPasswordLength());

7
commafeed-server/src/main/java/com/commafeed/backend/feed/parser/FeedParser.java
View File

@@ -23,7 +23,6 @@ import jakarta.inject.Singleton;
import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.ArrayUtils;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import org.apache.commons.lang3.SystemProperties;
import org.apache.commons.math3.stat.descriptive.SummaryStatistics; import org.apache.commons.math3.stat.descriptive.SummaryStatistics;
import org.jdom2.Element; import org.jdom2.Element;
import org.jdom2.Namespace; import org.jdom2.Namespace;
@@ -58,12 +57,6 @@ public class FeedParser {
public FeedParser(EncodingDetector encodingDetector, XMLCleaner xmlCleaner) { public FeedParser(EncodingDetector encodingDetector, XMLCleaner xmlCleaner) {
this.encodingDetector = encodingDetector; this.encodingDetector = encodingDetector;
this.xmlCleaner = xmlCleaner; this.xmlCleaner = xmlCleaner;
// disable entity expansion limits added in JDK24+ (#1961)
// we already strip doctype declarations in XMLCleaner to prevent xxe attacks
// we also already limit the size of feeds we download in HttpGetter
System.setProperty(SystemProperties.JDK_XML_MAX_GENERAL_ENTITY_SIZE_LIMIT, "0");
System.setProperty(SystemProperties.JDK_XML_TOTAL_ENTITY_SIZE_LIMIT, "0");
} }
public FeedParserResult parse(String feedUrl, byte[] xml) throws FeedParsingException { public FeedParserResult parse(String feedUrl, byte[] xml) throws FeedParsingException {