File _service:tar_scm:CVE-2020-25649.patch of Package jackson-databind

From 612f971b78c60202e9cd75a299050c8f2d724a59 Mon Sep 17 00:00:00 2001
From: Tatu Saloranta <tatu.saloranta@iki.fi>
Date: Thu, 9 Jan 2020 19:22:07 -0800
Subject: [PATCH] Fix #2589

---
 .../fasterxml/jackson/databind/ext/DOMDeserializer.java   | 8 ++++++++
 1 files changed, 8 insertions(+)

diff --git a/src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java b/src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java
index 74bc18da7b..e7c72ff98d 100644
--- a/src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java
+++ b/src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java
@@ -39,6 +39,14 @@
             // 14-Jul-2016, tatu: Not sure how or why, but during code coverage runs
             //   (via Cobertura) we get `java.lang.AbstractMethodError` so... ignore that too
         }
+
+        // [databind#2589] add two more settings just in case
+        try {
+            parserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        } catch (Throwable t) { } // as per previous one, nothing much to do
+        try {
+            parserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        } catch (Throwable t) { } // as per previous one, nothing much to do
         DEFAULT_PARSER_FACTORY = parserFactory;
     }