in src/main/java/org/apache/sling/xss/impl/xml/AntiSamyXmlParser.java [40:55]
public AntiSamyRules createRules(InputStream input) throws XMLStreamException, IOException {
XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
// disable external entities declarations
xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
XMLStreamReader xmlStreamReader = xmlInputFactory.createXMLStreamReader(input);
XmlMapper mapper = new XmlMapper(xmlInputFactory, XMLOutputFactory.newInstance());
AntiSamyRules rules = mapper.readValue(xmlStreamReader, AntiSamyRules.class);
if ("true".equals(rules.getDirectivesByName().get(DIRECTIVE_EMBED_STYLE_SHEETS))) {
logger.warn("Unsupported configuration directive {} is set to true and will be ignored",
DIRECTIVE_EMBED_STYLE_SHEETS);
}
xmlStreamReader.close();
return rules;
}