Files
2026-07-06 11:05:50 -04:00

16 lines
350 B
Go

package scan
import (
"encoding/xml"
"io"
)
// newSafeXMLDecoder disables external entity expansion so parseRSSItems is
// XXE-safe even when a malicious feed is served.
func newSafeXMLDecoder(r io.Reader) *xml.Decoder {
d := xml.NewDecoder(r)
d.Strict = false
d.Entity = map[string]string{} // no external/named entity resolution
return d
}