16 lines
350 B
Go
16 lines
350 B
Go
package scan
|
|
|
|
import (
|
|
"encoding/xml"
|
|
"io"
|
|
)
|
|
|
|
// newSafeXMLDecoder disables external entity expansion so parseRSSItems is
|
|
// XXE-safe even when a malicious feed is served.
|
|
func newSafeXMLDecoder(r io.Reader) *xml.Decoder {
|
|
d := xml.NewDecoder(r)
|
|
d.Strict = false
|
|
d.Entity = map[string]string{} // no external/named entity resolution
|
|
return d
|
|
}
|