From 41775c05aaf119ae53d3c2c79f8aabe6f5ebfa0f Mon Sep 17 00:00:00 2001
From: gaoqr <13665037151@163.com>
Date: Thu, 4 Sep 2025 15:53:28 +0800
Subject: [PATCH] =?UTF-8?q?sonar=E7=BC=96=E8=AF=91=E5=A4=B1=E8=B4=A5?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../admin/files/xml/DefaultOrderImportXmlParserHandler.java     | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/util/fileConversion/admin/files/xml/DefaultOrderImportXmlParserHandler.java b/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/util/fileConversion/admin/files/xml/DefaultOrderImportXmlParserHandler.java
index ac1da5f2e..25b98247f 100644
--- a/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/util/fileConversion/admin/files/xml/DefaultOrderImportXmlParserHandler.java
+++ b/cf-module-prod-executor/cf-module-prod-executor-biz/src/main/java/com/cf/imes/module/executor/util/fileConversion/admin/files/xml/DefaultOrderImportXmlParserHandler.java
@@ -225,6 +225,8 @@ public class DefaultOrderImportXmlParserHandler {
             //初始化工厂类以创建出XMLEventReader对象
             XMLInputFactory factory =
                     XMLInputFactory.newFactory();
+            factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+            factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
             is = file.getInputStream();
             //通过读取XML文件创建XMLEventReader
             XMLEventReader reader = factory.createXMLEventReader(is);