Fixing https://github.com/wso2/product-iots/issues/1624

components/mobile-plugins/android-plugin/org.wso2.carbon.device.mgt.mobile.android/src/main/java/org/wso2/carbon/device/mgt/mobile/android/impl/AndroidDeviceManager.java

@@ -47,6 +47,9 @@ import javax.xml.bind.JAXBContext;
 import javax.xml.bind.JAXBException;
 import javax.xml.bind.Marshaller;
 import javax.xml.bind.Unmarshaller;
+import javax.xml.stream.XMLInputFactory;
+import javax.xml.stream.XMLStreamException;
+import javax.xml.stream.XMLStreamReader;
 import java.io.StringReader;
 import java.io.StringWriter;
 import java.nio.charset.Charset;
@@ -128,17 +131,21 @@ public class AndroidDeviceManager implements DeviceManager {
                             MobileDeviceTypes.MOBILE_DEVICE_TYPE_ANDROID);
             resource = MobileDeviceManagementUtil.getRegistryResource(androidRegPath);
             if (resource != null) {
-                JAXBContext context = JAXBContext.newInstance(PlatformConfiguration.class);
-                Unmarshaller unmarshaller = context.createUnmarshaller();
-                return (PlatformConfiguration) unmarshaller.unmarshal(
+                XMLInputFactory factory = XMLInputFactory.newFactory();
+                factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+                factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+                XMLStreamReader reader = factory.createXMLStreamReader(
                         new StringReader(new String((byte[]) resource.getContent(), Charset.
                                 forName(AndroidPluginConstants.MobilePluginConstants.CHARSET_UTF8))));
+                JAXBContext context = JAXBContext.newInstance(PlatformConfiguration.class);
+                Unmarshaller unmarshaller = context.createUnmarshaller();
+                return (PlatformConfiguration) unmarshaller.unmarshal(reader);
             }
             return null;
         } catch (AndroidDeviceMgtPluginException e) {
             throw new DeviceManagementException(
                     "Error occurred while retrieving the Registry instance : " + e.getMessage(), e);
-        } catch (JAXBException e) {
+        } catch (JAXBException | XMLStreamException e) {
             throw new DeviceManagementException(
                     "Error occurred while parsing the Android configuration : " + e.getMessage(), e);
         } catch (RegistryException e) {

components/mobile-plugins/android-plugin/org.wso2.carbon.device.mgt.mobile.android/src/main/java/org/wso2/carbon/device/mgt/mobile/android/impl/util/MobileDeviceManagementUtil.java

@@ -66,6 +66,8 @@ public class MobileDeviceManagementUtil {
 	public static Document convertToDocument(File file) throws DeviceManagementException {
 		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
 		factory.setNamespaceAware(true);
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
 		try {
 			factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
 			DocumentBuilder docBuilder = factory.newDocumentBuilder();

components/mobile-plugins/windows-plugin/org.wso2.carbon.device.mgt.mobile.windows.api/src/main/java/org/wso2/carbon/device/mgt/mobile/windows/api/services/enrollment/impl/EnrollmentServiceImpl.java

@@ -231,6 +231,8 @@ public class EnrollmentServiceImpl implements EnrollmentService {
 
             DocumentBuilderFactory domFactory = DocumentBuilderFactory.newInstance();
             domFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            domFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+            domFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
             DocumentBuilder builder;
 
             builder = domFactory.newDocumentBuilder();

components/mobile-plugins/windows-plugin/org.wso2.carbon.device.mgt.mobile.windows.api/src/main/java/org/wso2/carbon/device/mgt/mobile/windows/api/services/wstep/impl/CertificateEnrollmentServiceImpl.java

@@ -239,6 +239,9 @@ public class CertificateEnrollmentServiceImpl implements CertificateEnrollmentSe
 
             DocumentBuilderFactory domFactory = DocumentBuilderFactory.newInstance();
             domFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            domFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+            domFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+
             DocumentBuilder builder = domFactory.newDocumentBuilder();
             Document document = builder.parse(wapProvisioningFilePath);
             NodeList wapParm = document.getElementsByTagName(PluginConstants.CertificateEnrolment.PARM);