Skip to content

Disable loading external DTDs by default, create system property to activate it #6474

@romani

Description

@romani

Ability to load external DTDs is considered as security issue, especially if DTDs are not hosted on https hosting.
Checkstyle used to rely on remote DTD files previously so such ability was enabled by default.
From 8.11 version checkstyle do not rely on remove DTDs if you use standard config, with standard DTDs.

UPGRADE INSTRUCTIONS: Users still can activate not very secure behavior by system property checkstyle.enableExternalDtdLoad, so simply make your CLI execution like java -Dcheckstyle.enableExternalDtdLoad=true -jar .......
Or activate system property by any other way in your checkstyle execution.

ATTENTION: user on old versions of checkstyle that reference to DTD files http (not secure) hosting on sourceforge.net will be forced to upgrade to at least to https versions of DTD files. Removal of DTDs on http hosting will be done in scope of - #6478.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions