Increase limits for XML parsing

To prepare for https://bugs.openjdk.org/browse/JDK-8343022 See also https://docs.oracle.com/en/java/javase/23/docs/api/java.xml/module-summary.html#Conf for documentation on these properties languagetool-org#11125
cushon · Dec 19, 2024 · 81e63c5 · 81e63c5
1 parent d9f9c11
commit 81e63c5
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/languagetool-core/src/main/java/org/languagetool/rules/patterns/PatternRuleLoader.java b/languagetool-core/src/main/java/org/languagetool/rules/patterns/PatternRuleLoader.java
@@ -73,6 +73,9 @@ public final List<AbstractPatternRule> getRules(InputStream is, String filename,
         Tools.setPasswordAuthenticator();
       }
       saxParser.getXMLReader().setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+      saxParser.getXMLReader().setProperty("jdk.xml.maxGeneralEntitySizeLimit", 0);
+      saxParser.getXMLReader().setProperty("jdk.xml.totalEntitySizeLimit", 0);
+      saxParser.getXMLReader().setProperty("jdk.xml.entityExpansionLimit", 0);
       saxParser.parse(is, handler);
       return handler.getRules();
     } catch (Exception e) {

diff --git a/...src/main/java/org/languagetool/tagging/disambiguation/rules/DisambiguationRuleLoader.java b/...src/main/java/org/languagetool/tagging/disambiguation/rules/DisambiguationRuleLoader.java
@@ -44,6 +44,9 @@ public final List<DisambiguationPatternRule> getRules(InputStream stream, Langua
     DisambiguationRuleHandler handler = new DisambiguationRuleHandler(language, xmlPath);
     SAXParserFactory factory = SAXParserFactory.newInstance();
     SAXParser saxParser = factory.newSAXParser();
+    saxParser.getXMLReader().setProperty("jdk.xml.maxGeneralEntitySizeLimit", 0);
+    saxParser.getXMLReader().setProperty("jdk.xml.totalEntitySizeLimit", 0);
+    saxParser.getXMLReader().setProperty("jdk.xml.entityExpansionLimit", 0);
 
     if (JLanguageTool.isCustomPasswordAuthenticatorUsed()) {
       Tools.setPasswordAuthenticator();