src/main/java/com/cloudbees/jenkins/support/configfiles/SecretHandler.java
private static Source createSafeSource(XMLReader reader, InputSource source) {
        try {
            reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
        } catch (SAXException ignored) {
            /* Fallback entity resolver will be used */
        }
        try {
            reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        } catch (SAXException ignored) {
            /* Fallback entity resolver will be used */
        }
         // Fallback in case the above features are not supported by the underlying XML library.
        reader.setEntityResolver((publicId, systemId) -> {
            return new InputSource(new ByteArrayInputStream(XXE_MARKER.getBytes(StandardCharsets.US_ASCII)));
        });
        return new SAXSource(reader, source);
    }
/**
     * Converts a Source into a Source that is protected against XXE attacks.
     * @see jenkins.util.xml.XMLUtils#safeTransform
     */
Converts a Source into a Source that is protected against XXE attacks.
Converts a Source into a Source that is protected against XXE attacks .
private static Source createSafeSource(XMLReader reader, InputSource source) {
        try {
            reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
        } catch (SAXException ignored) {
            /* Fallback entity resolver will be used */
        }
        try {
            reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        } catch (SAXException ignored) {
            /* Fallback entity resolver will be used */
        }
        reader.setEntityResolver((publicId, systemId) -> {
            return new InputSource(new ByteArrayInputStream(XXE_MARKER.getBytes(StandardCharsets.US_ASCII)));
        });
        return new SAXSource(reader, source);
    }
private static Source createSafeSource ( XMLReader reader , InputSource source ) { try { reader . setFeature ( "http://xml.org/sax/features/external-general-entities" , false ) ; } catch ( SAXException ignored ) { /* Fallback entity resolver will be used */ } try { reader . setFeature ( "http://xml.org/sax/features/external-parameter-entities" , false ) ; } catch ( SAXException ignored ) { /* Fallback entity resolver will be used */ } reader . setEntityResolver ( ( publicId , systemId ) -> { return new InputSource ( new ByteArrayInputStream ( XXE_MARKER . getBytes ( StandardCharsets . US_ASCII ) ) ) ; } ) ; return new SAXSource ( reader , source ) ; }
Converts a Source into a Source that is protected against XXE attacks.
Converts a Source into a Source that is protected against XXE attacks .
// Fallback in case the above features are not supported by the underlying XML library.