BATIK-1349: Block loading external resource by default
git-svn-id: https://svn.apache.org/repos/asf/xmlgraphics/batik/trunk@1905050 13f79535-47bb-0310-9956-ffa450edef68
diff --git a/batik-bridge/src/main/java/org/apache/batik/bridge/UserAgentAdapter.java b/batik-bridge/src/main/java/org/apache/batik/bridge/UserAgentAdapter.java
index d163acf..7c415dd 100644
--- a/batik-bridge/src/main/java/org/apache/batik/bridge/UserAgentAdapter.java
+++ b/batik-bridge/src/main/java/org/apache/batik/bridge/UserAgentAdapter.java
@@ -362,7 +362,7 @@
public ExternalResourceSecurity
getExternalResourceSecurity(ParsedURL resourceURL,
ParsedURL docURL) {
- return new RelaxedExternalResourceSecurity(resourceURL, docURL);
+ return new DefaultExternalResourceSecurity(resourceURL, docURL);
}
/**
diff --git a/batik-transcoder/src/main/java/org/apache/batik/transcoder/SVGAbstractTranscoder.java b/batik-transcoder/src/main/java/org/apache/batik/transcoder/SVGAbstractTranscoder.java
index bc4d233..98cfc10 100644
--- a/batik-transcoder/src/main/java/org/apache/batik/transcoder/SVGAbstractTranscoder.java
+++ b/batik-transcoder/src/main/java/org/apache/batik/transcoder/SVGAbstractTranscoder.java
@@ -32,11 +32,11 @@
import org.apache.batik.bridge.BaseScriptingEnvironment;
import org.apache.batik.bridge.BridgeContext;
import org.apache.batik.bridge.BridgeException;
-import org.apache.batik.bridge.DefaultExternalResourceSecurity;
import org.apache.batik.bridge.DefaultScriptSecurity;
import org.apache.batik.bridge.ExternalResourceSecurity;
import org.apache.batik.bridge.GVTBuilder;
import org.apache.batik.bridge.NoLoadScriptSecurity;
+import org.apache.batik.bridge.RelaxedExternalResourceSecurity;
import org.apache.batik.bridge.RelaxedScriptSecurity;
import org.apache.batik.bridge.SVGUtilities;
import org.apache.batik.bridge.ScriptSecurity;
@@ -1116,9 +1116,9 @@
public ExternalResourceSecurity getExternalResourceSecurity(ParsedURL resourceURL, ParsedURL docURL) {
if (isAllowExternalResources()) {
- return super.getExternalResourceSecurity(resourceURL, docURL);
+ return new RelaxedExternalResourceSecurity(resourceURL, docURL);
}
- return new DefaultExternalResourceSecurity(resourceURL, docURL);
+ return super.getExternalResourceSecurity(resourceURL, docURL);
}
public boolean isAllowExternalResources() {
