using Velocity to externalize configuration properties ?

[Cantor, Scott]

On 8/1/13 8:00 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>Well, to be fair to them, it doesn't actually work that way when you use
>it correctly.  All their schemas are local to their jars and they have a
>proprietary XML catalog-ish mechanism which resolves those locally from
>the classpath.

The real failing is that they have not prevented remote lookup. That's the
underlying bug I'd like to fix. It may be that it isn't done under
ordinary use and we're causing it to do that, but it should never even
try, for security and reliability reasons.

I did look into possibly trying to inject an EntityResolver, but I didn't
pursue it to the point of trying it.

-- Scott