From 566757b223b82664aa55f56082cd238602a5f650 Mon Sep 17 00:00:00 2001
From: KozakLordOfMatrix <matrixneo2026@tutamail.com>
Date: Tue, 7 Jul 2026 18:15:22 +0300
Subject: [PATCH 1/2] security: restrict external resource access in
 XSLTProcessor

---
 .../javascript/host/xml/XSLTProcessor.java     | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/main/java/org/htmlunit/javascript/host/xml/XSLTProcessor.java b/src/main/java/org/htmlunit/javascript/host/xml/XSLTProcessor.java
index 4fc971aea96..5a7325577ac 100644
--- a/src/main/java/org/htmlunit/javascript/host/xml/XSLTProcessor.java
+++ b/src/main/java/org/htmlunit/javascript/host/xml/XSLTProcessor.java
@@ -129,6 +129,18 @@ private Object transform(final Node source) {
             // which sets a number of processing limits on the processors. Conversely, by default,
             // the JDK turns off FSP for transformers and XPath, which enables extension functions for XSLT and XPath.
             transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            try {
+                transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+            }
+            catch (final IllegalArgumentException ignored) {
+                // ignore
+            }
+            try {
+                transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+            }
+            catch (final IllegalArgumentException ignored) {
+                // ignore
+            }
 
             final SgmlPage page = sourceDomNode.getPage();
             if (page != null && page.getWebClient().getBrowserVersion()
@@ -191,6 +203,12 @@ public Charset getContentCharset() {
             }
 
             final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+            try {
+                factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            }
+            catch (final javax.xml.parsers.ParserConfigurationException ignored) {
+                // ignore
+            }
             final org.w3c.dom.Document containerDocument = factory.newDocumentBuilder().newDocument();
             final org.w3c.dom.Element containerElement = containerDocument.createElement("container");
             containerDocument.appendChild(containerElement);

From 555e73a77b117f37e258acca34da872bc9f79c43 Mon Sep 17 00:00:00 2001
From: MatrixNeoKozak <matrixneo2026@tutamail.com>
Date: Wed, 8 Jul 2026 13:39:04 +0300
Subject: [PATCH 2/2] chore: add MatrixNeoKozak to authors and contributors

---
 pom.xml                                                       | 4 ++++
 .../java/org/htmlunit/javascript/host/xml/XSLTProcessor.java  | 1 +
 2 files changed, 5 insertions(+)

diff --git a/pom.xml b/pom.xml
index 9fc00828ac4..6d2d958d9e9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1417,6 +1417,10 @@
         <contributor>
             <name>Sebastian Peters</name>
         </contributor>
+        <contributor>
+            <name>MatrixNeoKozak</name>
+            <email>matrixneo2026@tutamail.com</email>
+        </contributor>
     </contributors>
     <dependencies>
         <!-- this includes httpclient as dependency -->
diff --git a/src/main/java/org/htmlunit/javascript/host/xml/XSLTProcessor.java b/src/main/java/org/htmlunit/javascript/host/xml/XSLTProcessor.java
index 5a7325577ac..21389e91dac 100644
--- a/src/main/java/org/htmlunit/javascript/host/xml/XSLTProcessor.java
+++ b/src/main/java/org/htmlunit/javascript/host/xml/XSLTProcessor.java
@@ -58,6 +58,7 @@
  *
  * @author Ahmed Ashour
  * @author Ronald Brill
+ * @author MatrixNeoKozak
  */
 @JsxClass
 public class XSLTProcessor extends HtmlUnitScriptable {