Prevent XXE injection when parsing XML

scala-steward · Aug 16, 2021 · 26c9e74 · 26c9e74
1 parent c842903
commit 26c9e74
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/play-ws-standalone-xml/src/main/scala/play/api/libs/ws/XMLBodyReadables.scala b/play-ws-standalone-xml/src/main/scala/play/api/libs/ws/XMLBodyReadables.scala
@@ -25,7 +25,7 @@ trait XMLBodyReadables {
    * }}}
    */
   implicit val readableAsXml: BodyReadable[Elem] = BodyReadable { response =>
-    xml.XML.load(new InputSource(new ByteArrayInputStream(response.bodyAsBytes.toArray)))
+    XML.parser.load(new InputSource(new ByteArrayInputStream(response.bodyAsBytes.toArray)))
   }
 
 }