Skip to content

Y
YeeAmosFireAutoSysRoot
Commit 719f672a authored by 李秀明's avatar 李秀明
Browse files
Options

fix: XSLT Injection(XSLT注入)

Links https://docs.qq.com/sheet/DTkRSaWhSZXBlaldN?tab=000008&_t=1711087563249 (No.23)
parent 6d26e415
Hide whitespace changes
Inline Side-by-side
Showing with 3 additions and 0 deletions
YeeAmosFireAutoSysService/src/main/java/com/yeejoin/amos/fas/core/util/WordConverterUtils.java
View file @ 719f672a
...@@ -6,6 +6,7 @@ import org.apache.poi.xwpf.converter.xhtml.XHTMLConverter; ...@@ -6,6 +6,7 @@ import org.apache.poi.xwpf.converter.xhtml.XHTMLConverter;
import org.apache.poi.xwpf.converter.xhtml.XHTMLOptions; import org.apache.poi.xwpf.converter.xhtml.XHTMLOptions;
import org.apache.poi.xwpf.usermodel.XWPFDocument; import org.apache.poi.xwpf.usermodel.XWPFDocument;
import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.transform.OutputKeys; import javax.xml.transform.OutputKeys;
import javax.xml.transform.Transformer; import javax.xml.transform.Transformer;
...@@ -104,6 +105,7 @@ public class WordConverterUtils { ...@@ -104,6 +105,7 @@ public class WordConverterUtils {
DOMSource domSource = new DOMSource(htmlDocument); DOMSource domSource = new DOMSource(htmlDocument);
StreamResult streamResult = new StreamResult(targetFile); StreamResult streamResult = new StreamResult(targetFile);
TransformerFactory tf = TransformerFactory.newInstance(); TransformerFactory tf = TransformerFactory.newInstance();
tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
Transformer serializer = tf.newTransformer(); Transformer serializer = tf.newTransformer();
serializer.setOutputProperty(OutputKeys.ENCODING, "utf-8"); serializer.setOutputProperty(OutputKeys.ENCODING, "utf-8");
serializer.setOutputProperty(OutputKeys.INDENT, "yes"); serializer.setOutputProperty(OutputKeys.INDENT, "yes");
...@@ -150,6 +152,7 @@ public class WordConverterUtils { ...@@ -150,6 +152,7 @@ public class WordConverterUtils {
StringWriter stringWriter = new StringWriter(); StringWriter stringWriter = new StringWriter();
StreamResult streamResult = new StreamResult(stringWriter); StreamResult streamResult = new StreamResult(stringWriter);
TransformerFactory tf = TransformerFactory.newInstance(); TransformerFactory tf = TransformerFactory.newInstance();
tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
Transformer serializer = tf.newTransformer(); Transformer serializer = tf.newTransformer();
serializer.setOutputProperty(OutputKeys.ENCODING, "utf-8"); serializer.setOutputProperty(OutputKeys.ENCODING, "utf-8");
serializer.setOutputProperty(OutputKeys.INDENT, "yes"); serializer.setOutputProperty(OutputKeys.INDENT, "yes");
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment