Fixing https://github.com/wso2/product-iots/issues/1624

components/apimgt-extensions/org.wso2.carbon.apimgt.handlers/src/main/java/org/wso2/carbon/apimgt/handlers/utils/Utils.java

@@ -123,6 +123,8 @@ public class Utils {
     private static Document convertToDocument(File file) throws APIMCertificateMGTException {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         factory.setNamespaceAware(true);
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
         try {
             DocumentBuilder docBuilder = factory.newDocumentBuilder();
             factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

components/apimgt-extensions/org.wso2.carbon.apimgt.integration.client/src/main/java/org/wso2/carbon/apimgt/integration/client/configs/APIMConfigReader.java

@@ -78,6 +78,8 @@ public class APIMConfigReader {
     private static Document convertToDocument(File file) throws APIMClientException {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         factory.setNamespaceAware(true);
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
         try {
             factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
             DocumentBuilder docBuilder = factory.newDocumentBuilder();

components/apimgt-extensions/org.wso2.carbon.apimgt.webapp.publisher/src/main/java/org/wso2/carbon/apimgt/webapp/publisher/WebappPublisherUtil.java

@@ -34,6 +34,8 @@ public class WebappPublisherUtil {
     public static Document convertToDocument(File file) throws WebappPublisherConfigurationFailedException {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         factory.setNamespaceAware(true);
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
         try {
             factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
             DocumentBuilder docBuilder = factory.newDocumentBuilder();

components/certificate-mgt/org.wso2.carbon.certificate.mgt.core/src/main/java/org/wso2/carbon/certificate/mgt/core/util/CertificateManagementConstants.java

@@ -38,7 +38,7 @@ public final class CertificateManagementConstants {
     public static final String RSA_PRIVATE_KEY_BEGIN_TEXT = "-----BEGIN RSA PRIVATE KEY-----\n";
     public static final String RSA_PRIVATE_KEY_END_TEXT = "-----END RSA PRIVATE KEY-----";
     public static final String EMPTY_TEXT = "";
-    public static final int RSA_KEY_LENGTH = 1024;
+    public static final int RSA_KEY_LENGTH = 2048;
 
     public static final class DataBaseTypes {
         private DataBaseTypes() {

components/certificate-mgt/org.wso2.carbon.certificate.mgt.core/src/main/java/org/wso2/carbon/certificate/mgt/core/util/CertificateManagerUtil.java

@@ -45,6 +45,8 @@ public class CertificateManagerUtil {
 
     public static Document convertToDocument(File file) throws CertificateManagementException {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
         factory.setNamespaceAware(true);
         try {
             DocumentBuilder docBuilder = factory.newDocumentBuilder();

components/device-mgt-extensions/org.wso2.carbon.device.mgt.extensions.device.type.deployer/src/main/java/org/wso2/carbon/device/mgt/extensions/device/type/deployer/util/DeviceTypeConfigUtil.java

@@ -35,6 +35,8 @@ public class DeviceTypeConfigUtil {
     public static Document convertToDocument(File file) throws DeviceTypeConfigurationException {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         factory.setNamespaceAware(true);
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
         try {
             factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
             DocumentBuilder docBuilder = factory.newDocumentBuilder();

components/device-mgt/org.wso2.carbon.device.mgt.core/src/main/java/org/wso2/carbon/device/mgt/core/config/tenant/PlatformConfigurationManagementServiceImpl.java

@@ -31,6 +31,9 @@ import javax.xml.bind.JAXBContext;
 import javax.xml.bind.JAXBException;
 import javax.xml.bind.Marshaller;
 import javax.xml.bind.Unmarshaller;
+import javax.xml.stream.XMLInputFactory;
+import javax.xml.stream.XMLStreamException;
+import javax.xml.stream.XMLStreamReader;
 import java.io.StringReader;
 import java.io.StringWriter;
 import java.nio.charset.Charset;
@@ -80,14 +83,19 @@ public class PlatformConfigurationManagementServiceImpl
 		try {
 			resource = ConfigurationManagerUtil.getRegistryResource(resourcePath);
 			if(resource != null){
-				JAXBContext context = JAXBContext.newInstance(PlatformConfiguration.class);
+				XMLInputFactory factory = XMLInputFactory.newFactory();
-				Unmarshaller unmarshaller = context.createUnmarshaller();
+				factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
-				return (PlatformConfiguration) unmarshaller.unmarshal(
+				factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+				XMLStreamReader reader = factory.createXMLStreamReader(
 						new StringReader(new String((byte[]) resource.getContent(), Charset
 								.forName(ConfigurationManagerConstants.CharSets.CHARSET_UTF8))));
+
+				JAXBContext context = JAXBContext.newInstance(PlatformConfiguration.class);
+				Unmarshaller unmarshaller = context.createUnmarshaller();
+				return (PlatformConfiguration) unmarshaller.unmarshal(reader);
 			}
 			return new PlatformConfiguration();
-		} catch (JAXBException e) {
+		} catch (JAXBException | XMLStreamException e) {
 			throw new ConfigurationManagementException(
 					"Error occurred while parsing the Tenant configuration : " + e.getMessage(), e);
 		} catch (RegistryException e) {

components/device-mgt/org.wso2.carbon.device.mgt.core/src/main/java/org/wso2/carbon/device/mgt/core/util/DeviceManagerUtil.java

@@ -82,6 +82,8 @@ public final class DeviceManagerUtil {
 
     public static Document convertToDocument(File file) throws DeviceManagementException {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
         factory.setNamespaceAware(true);
         try {
             DocumentBuilder docBuilder = factory.newDocumentBuilder();

components/device-mgt/org.wso2.carbon.device.mgt.extensions/src/main/java/org/wso2/carbon/device/mgt/extensions/device/type/template/DeviceTypeManager.java

@@ -50,6 +50,9 @@ import javax.xml.bind.JAXBContext;
 import javax.xml.bind.JAXBException;
 import javax.xml.bind.Marshaller;
 import javax.xml.bind.Unmarshaller;
+import javax.xml.stream.XMLInputFactory;
+import javax.xml.stream.XMLStreamException;
+import javax.xml.stream.XMLStreamReader;
 import java.io.File;
 import java.io.StringReader;
 import java.io.StringWriter;
@@ -235,11 +238,16 @@ public class DeviceTypeManager implements DeviceManager {
         try {
             resource = DeviceTypeUtils.getRegistryResource(deviceType);
             if (resource != null) {
+                XMLInputFactory factory = XMLInputFactory.newFactory();
+                factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+                factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+                XMLStreamReader reader = factory.createXMLStreamReader(
+                        new StringReader(new String((byte[]) resource.getContent(), Charset
+                                .forName(DeviceTypePluginConstants.CHARSET_UTF8))));
+
                 JAXBContext context = JAXBContext.newInstance(PlatformConfiguration.class);
                 Unmarshaller unmarshaller = context.createUnmarshaller();
-                return (PlatformConfiguration) unmarshaller.unmarshal(
+                return (PlatformConfiguration) unmarshaller.unmarshal(reader);
-                        new StringReader(new String((byte[]) resource.getContent(), Charset.
-                                forName(DeviceTypePluginConstants.CHARSET_UTF8))));
             } else if (defaultPlatformConfiguration != null) {
                 return defaultPlatformConfiguration;
             }
@@ -247,7 +255,7 @@ public class DeviceTypeManager implements DeviceManager {
         } catch (DeviceTypeMgtPluginException e) {
             throw new DeviceManagementException(
                     "Error occurred while retrieving the Registry instance : " + e.getMessage(), e);
-        } catch (JAXBException e) {
+        } catch (JAXBException | XMLStreamException e) {
             throw new DeviceManagementException(
                     "Error occurred while parsing the " + deviceType + " configuration : " + e.getMessage(), e);
         } catch (RegistryException e) {

components/device-mgt/org.wso2.carbon.device.mgt.extensions/src/main/java/org/wso2/carbon/device/mgt/extensions/device/type/template/util/DeviceTypeUtils.java

@@ -140,6 +140,8 @@ public class DeviceTypeUtils {
     public static Document convertToDocument(File file) throws DeviceTypeMgtPluginException {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         factory.setNamespaceAware(true);
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
         try {
             factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
             DocumentBuilder docBuilder = factory.newDocumentBuilder();

components/policy-mgt/org.wso2.carbon.policy.mgt.core/src/main/java/org/wso2/carbon/policy/mgt/core/util/PolicyManagerUtil.java

@@ -61,6 +61,8 @@ public class PolicyManagerUtil {
     public static Document convertToDocument(File file) throws PolicyManagementException {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         factory.setNamespaceAware(true);
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
         try {
             DocumentBuilder docBuilder = factory.newDocumentBuilder();
             factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);