lsm/hutool
1
0
Fork 0
mirror of https://gitee.com/dromara/hutool.git synced 2025-05-08 06:37:58 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix code

Browse Source
This commit is contained in:
Looly 2022-11-10 11:11:09 +08:00
parent 912c3e116d
commit 5bd54dcd39
3 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
hutool-core/src/main/java/cn/hutool/core/classloader/JarClassLoader.java
View File

@ -55,7 +55,6 @@ public class JarClassLoader extends URLClassLoader {
try { try {
final Method method = MethodUtil.getMethod(URLClassLoader.class, "addURL", URL.class); final Method method = MethodUtil.getMethod(URLClassLoader.class, "addURL", URL.class);
if (null != method) { if (null != method) {
method.setAccessible(true);
final List<File> jars = loopJar(jarFile); final List<File> jars = loopJar(jarFile);
for (final File jar : jars) { for (final File jar : jars) {
MethodUtil.invoke(loader, method, jar.toURI().toURL()); MethodUtil.invoke(loader, method, jar.toURI().toURL());

5
hutool-core/src/main/java/cn/hutool/core/util/XmlUtil.java
View File

@ -308,6 +308,9 @@ public class XmlUtil {
// 3.得到解读器 // 3.得到解读器
reader = parse.getXMLReader(); reader = parse.getXMLReader();
// 防止XEE攻击，见：https://www.jianshu.com/p/1a857905b22c
reader.setFeature("http://xml.org/sax/features/external-general-entities",false);
reader.setFeature("http://xml.org/sax/features/external-parameter-entities",false);
reader.setContentHandler(contentHandler); reader.setContentHandler(contentHandler);
reader.parse(source); reader.parse(source);
} catch (final ParserConfigurationException | SAXException e) { } catch (final ParserConfigurationException | SAXException e) {
@ -616,6 +619,8 @@ public class XmlUtil {
public static void transform(final Source source, final Result result, final String charset, final int indent, final boolean omitXmlDeclaration) { public static void transform(final Source source, final Result result, final String charset, final int indent, final boolean omitXmlDeclaration) {
final TransformerFactory factory = TransformerFactory.newInstance(); final TransformerFactory factory = TransformerFactory.newInstance();
try { try {
// 防止XXE攻击，见：https://www.jianshu.com/p/1a857905b22c
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
final Transformer xformer = factory.newTransformer(); final Transformer xformer = factory.newTransformer();
if (indent > 0) { if (indent > 0) {
xformer.setOutputProperty(OutputKeys.INDENT, "yes"); xformer.setOutputProperty(OutputKeys.INDENT, "yes");

3
hutool-swing/src/main/java/cn/hutool/swing/img/gif/LZWEncoder.java
View File

@ -213,9 +213,10 @@ class LZWEncoder {
if (free_ent < maxmaxcode) { if (free_ent < maxmaxcode) {
codetab[i] = free_ent++; // code -> hashtable codetab[i] = free_ent++; // code -> hashtable
htab[i] = fcode; htab[i] = fcode;
} else } else {
cl_block(outs); cl_block(outs);
} }
}
// Put out the final code. // Put out the final code.
output(ent, outs); output(ent, outs);
output(EOFCode, outs); output(EOFCode, outs);