Disable the processing of external entities in SourceHttpMessageConverter by default [SPR-11078]

[spring-projects-issues]

Rossen Stoyanchev opened SPR-11078 and commented

This is a follow-up fix related to the issue reported in #15432.

---

Affects: 3.2.4, 4.0 RC1

Issue Links:

• Fix potential security risk when using Spring OXM [SPR-10806] #15432 Fix potential security risk when using Spring OXM
• Jaxb2RootElementHttpMessageConverter is susceptible to XXE vulnerability [SPR-11376] #16003 Jaxb2RootElementHttpMessageConverter is susceptible to XXE vulnerability