From 22a767c3ac6e6cffe28a27cc3d8a69be5063077d Mon Sep 17 00:00:00 2001 From: Tyler Roach Date: Fri, 7 Jul 2023 20:33:40 -0400 Subject: [PATCH] Revert "fix(core): added fix for xml parser (#3100)" (#3353) This reverts commit c3e6d69422e1f0c80fe53f2d757b8df97619af2b. --- .../regions/RegionMetadataParser.java | 7 +++---- .../java/com/amazonaws/util/XpathUtils.java | 20 +------------------ 2 files changed, 4 insertions(+), 23 deletions(-) diff --git a/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java b/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java index 7c413fd591..caed9c468e 100644 --- a/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java +++ b/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java @@ -109,10 +109,9 @@ private static List internalParse( Document document; try { - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - factory.setXIncludeAware(false); - factory.setExpandEntityReferences(false); + DocumentBuilderFactory factory = + DocumentBuilderFactory.newInstance(); + DocumentBuilder documentBuilder = factory.newDocumentBuilder(); document = documentBuilder.parse(input); diff --git a/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java b/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java index 746c990290..18c35fc2f9 100644 --- a/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java +++ b/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java @@ -45,25 +45,7 @@ public class XpathUtils { /** Shared logger */ private static Log log = LogFactory.getLog(XpathUtils.class); - private static DocumentBuilderFactory factory = getDocumentBuilderFactory(); - - - /** - * Creates new documentbuilderfactory object - * @return DocumentBuilderFactory. - */ - private static DocumentBuilderFactory getDocumentBuilderFactory() { - try { - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); - dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - dbf.setXIncludeAware(false); // Default false for java 8. Disable XML Inclusions leading to SSRF - https://portswigger.net/web-security/xxe/lab-xinclude-attack - dbf.setExpandEntityReferences(false); - return dbf; - } - catch (ParserConfigurationException exception){ - return null; - } - } + private static DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); /** * InputStream to Document.