diff --git a/src/main/java/gov/nasa/pds/tools/label/SchematronTransformer.java b/src/main/java/gov/nasa/pds/tools/label/SchematronTransformer.java index 6360e4aff..4602755da 100644 --- a/src/main/java/gov/nasa/pds/tools/label/SchematronTransformer.java +++ b/src/main/java/gov/nasa/pds/tools/label/SchematronTransformer.java @@ -21,6 +21,7 @@ import java.net.URL; import java.nio.charset.StandardCharsets; import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.XMLConstants; import javax.xml.transform.Source; import javax.xml.transform.Transformer; import javax.xml.transform.TransformerConfigurationException; @@ -61,6 +62,13 @@ public SchematronTransformer() throws TransformerConfigurationException { private Transformer buildIsoTransformer() throws TransformerConfigurationException { TransformerFactory isoFactory = TransformerFactory.newInstance(); + try { + isoFactory.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true); + isoFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); + isoFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); + } catch (TransformerConfigurationException e) { + throw new TransformerConfigurationException("Failed to configure TransformerFactory for secure processing", e); + } // Set the resolver that will look in the jar for imports isoFactory.setURIResolver(new XslURIResolver()); // Load the isoSchematron stylesheet that will be used to transform each