[JBEAP-19150] JSF trying to load DTD over the network

[moulalis]

Issue: https://issues.redhat.com/browse/JBEAP-19150
Upstream issue: eclipse-ee4j/mojarra#4699
Upstream PR : eclipse-ee4j/mojarra#4701

[spyrkob]

@moulalis can you link the upstream issue and PR in the description please

[rmartinc]

@moulalis Please try to also fix the same issue in the method getFacesConfigXmlVersion (just above the method you have modified). Maybe you have to reuse the createDocumentBuilderFactory to create the factory. And in the setFeature method try to catch the ParserConfigurationException in order to support another implementations (if that feature is not supported just do nothing, check the other methods too, if some exception can be thrown). Note that I just applied the recommended settings from owasp.

[moulalis]

@moulalis Please try to also fix the same issue in the method getFacesConfigXmlVersion (just above the method you have modified). Maybe you have to reuse the createDocumentBuilderFactory to create the factory. And in the setFeature method try to catch the ParserConfigurationException in order to support another implementations (if that feature is not supported just do nothing, check the other methods too, if some exception can be thrown). Note that I just applied the recommended settings from owasp.

@rmartinc I am done the above changes, please verify. Regarding the Exception the setFeature is throwing "ParserConfigurationException" I have handled that separately. on dbf.newDocumentBuilder().parse(stream) line there are two exceptions thrown ParserConfigurationException and SAXException handled that at the end.

[rmartinc]

The functionality is OK to me now. But the indentation seems to be strange (maybe you are using tabs and not spaces or similar). And we just do one commit for JIRA, so squash the three changes into just one.

With those two things is OK to me.

[moulalis]

The functionality is OK to me now. But the indentation seems to be strange (maybe you are using tabs and not spaces or similar). And we just do one commit for JIRA, so squash the three changes into just one.

With those two things is OK to me.

@rmartinc Formatted and squashed.