From 5c9ca481786478b99cb1c5e145a8e066dbed5115 Mon Sep 17 00:00:00 2001 From: Eric Seokgon Lee Date: Thu, 3 Sep 2026 10:16:55 +0900 Subject: [PATCH] =?UTF-8?q?chore:=20NexusPropertyPage=EC=9D=98=20DocumentB?= =?UTF-8?q?uilderFactory=20=EC=99=B8=EB=B6=80=20=EC=97=94=ED=8B=B0?= =?UTF-8?q?=ED=8B=B0=20=EC=B0=A8=EB=8B=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 파싱 대상이 고정 문자열이라 실제 공격 경로는 없으나, 동일 유형 설정을 일관되게 적용해 방어를 맞춘다. --- .../dev/imp/confmngt/properties/NexusPropertyPage.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/egovframework.dev.imp.confmngt/src/egovframework/dev/imp/confmngt/properties/NexusPropertyPage.java b/egovframework.dev.imp.confmngt/src/egovframework/dev/imp/confmngt/properties/NexusPropertyPage.java index 107776bda..214b95161 100644 --- a/egovframework.dev.imp.confmngt/src/egovframework/dev/imp/confmngt/properties/NexusPropertyPage.java +++ b/egovframework.dev.imp.confmngt/src/egovframework/dev/imp/confmngt/properties/NexusPropertyPage.java @@ -408,6 +408,11 @@ public boolean performOk() { }else{ //dependencies 바로 앞에 repositories 위치 DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + // XXE(XML External Entity Injection, CWE-611) 취약점 방지 + factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + factory.setXIncludeAware(false); DocumentBuilder builder = factory.newDocumentBuilder(); Document doc = builder.parse(new InputSource(new StringReader(xmlStr))); Node node = doc.getDocumentElement();