I am working on spring boot 2.3.3. and restTemplate. Below is the piece of code for fetching an XML:
RestTemplate rt = new RestTemplate(); rt.exchange(baseURL + path, HttpMethod.GET, httpEntity, classObj);
I have test case with a sample XML and DOCTYPE that should fail in parsing, but it doesn't. Rest template seems to be parsing the XML properly. XML :
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE MyResponse SYSTEM "http://example.com:8080/some/path/MyResponse.dtd">
<ABC xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<XYZ>
</XYZ>
</ABC>
If I add entities to the XML, the parsing fails with OOM error.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE lolz [<!ENTITY lol 'lol'><!ENTITY lol1 '&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;'><!ENTITY lol2 '&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;'><!ENTITY lol3 '&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;'><!ENTITY lol4 '&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;'><!ENTITY lol5 '&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;'><!ENTITY lol6 '&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;'><!ENTITY lol7 '&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;'><!ENTITY lol8 '&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;'><!ENTITY lol9 '&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;'>]><lolz>&lol9;</lolz>
<ABC xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<XYZ>
</XYZ>
</ABC>
How can I prevent restTemplate from parsing the doctype. When I run the test in debug mode, I can see that Jaxb2RootElementHttpMessageConverter in restTemplate has isSupportDtd set to false already, which doesn't seem to be working.