diff --git a/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java b/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java index 7c413fd591..caed9c468e 100644 --- a/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java +++ b/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java @@ -109,10 +109,9 @@ private static List internalParse( Document document; try { - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - factory.setXIncludeAware(false); - factory.setExpandEntityReferences(false); + DocumentBuilderFactory factory = + DocumentBuilderFactory.newInstance(); + DocumentBuilder documentBuilder = factory.newDocumentBuilder(); document = documentBuilder.parse(input); diff --git a/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java b/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java index 746c990290..18c35fc2f9 100644 --- a/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java +++ b/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java @@ -45,25 +45,7 @@ public class XpathUtils { /** Shared logger */ private static Log log = LogFactory.getLog(XpathUtils.class); - private static DocumentBuilderFactory factory = getDocumentBuilderFactory(); - - - /** - * Creates new documentbuilderfactory object - * @return DocumentBuilderFactory. - */ - private static DocumentBuilderFactory getDocumentBuilderFactory() { - try { - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); - dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - dbf.setXIncludeAware(false); // Default false for java 8. Disable XML Inclusions leading to SSRF - https://portswigger.net/web-security/xxe/lab-xinclude-attack - dbf.setExpandEntityReferences(false); - return dbf; - } - catch (ParserConfigurationException exception){ - return null; - } - } + private static DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); /** * InputStream to Document.