fix XML External Entity (XXE) Injection (#172)

Author: Robothy

local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java

@@ -122,6 +122,9 @@ private ServiceFactory createServiceFactory() {
 
     XMLInputFactory input = new WstxInputFactory();
     input.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, Boolean.FALSE);
+    input.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE); // Disable DTDs
+    input.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); // Disable external entities
+
     XmlMapper xmlMapper = new XmlMapper(new XmlFactory(input, new WstxOutputFactory()));
     xmlMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
     xmlMapper.registerModule(new Jdk8Module());

local-s3-rest/src/main/java/com/robothy/s3/rest/utils/XmlUtils.java

@@ -17,6 +17,8 @@ public class XmlUtils {
   static {
     XMLInputFactory input = new WstxInputFactory();
     input.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, Boolean.FALSE);
+    input.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
+    input.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
     xmlMapper = new XmlMapper(new XmlFactory(input, new WstxOutputFactory()));
     xmlMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
     xmlMapper.registerModule(new Jdk8Module());