Prevent XML parser from loading external entities

This commit is contained in:
Mae 2023-08-04 22:24:17 +01:00 committed by Mark Felder
parent 1062185ba0
commit ca0859b90f
1 changed files with 4 additions and 1 deletions

View File

@ -29,7 +29,10 @@ def parse_document(text) do
{doc, _rest} =
text
|> :binary.bin_to_list()
|> :xmerl_scan.string(quiet: true)
|> :xmerl_scan.string(
quiet: true,
fetch_fun: fn _, _ -> raise "Resolving external entities not supported" end
)
{:ok, doc}
rescue