Package org.craftercms.engine.url.rewrite

Class SecuredConf

java.lang.Object
org.tuckey.web.filters.urlrewrite.Conf
org.craftercms.engine.url.rewrite.SecuredConf
public final class SecuredConf extends org.tuckey.web.filters.urlrewrite.Conf
Tuckey Conf that loads URL rewrite XML without resolving external entities.

Shipped site configuration declares the Tuckey DTD, so rejecting every DOCTYPE would stop those sites from loading. This parser accepts only the DTD public ids packaged in urlrewritefilter and reads those DTDs from that jar. Internal subsets and any other entity are rejected. Conf.loadDom(InputStream) is not used.

Conf's constructor calls loadDom before any instance field on this class could be initialized. Parser settings and the DTD allowlist are static. Parse failures are written to Conf.getErrors(), which Conf initializes before that call. loadDom must not read instance fields.

  • Field Summary

    Fields inherited from class org.tuckey.web.filters.urlrewrite.Conf

    decodeUsing, defaultMatchType, useContext, useQueryString

  • Constructor Summary

    Constructors
    Constructor
    Description
    SecuredConf(jakarta.servlet.ServletContext context, InputStream inputStream, String fileName, String systemId, boolean modRewriteStyleConf)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    loadDom(InputStream inputStream)
    Replaces Tuckey's parser.

    Methods inherited from class org.tuckey.web.filters.urlrewrite.Conf

    addOutboundRule, addRule, destroy, getCatchElems, getDecodeUsing, getDefaultMatchType, getErrors, getFileName, getLoadedDate, getOutboundRules, getRules, initialise, isDecodeUsingCustomCharsetRequired, isDecodeUsingEncodingHeader, isEngineEnabled, isLoadedFromFile, isOk, isUseContext, isUseQueryString, loadModRewriteStyle, processConfDoc, setDecodeUsing, setDefaultMatchType, setEngineEnabled, setUseContext, setUseQueryString

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • SecuredConf

      public SecuredConf(jakarta.servlet.ServletContext context, InputStream inputStream, String fileName, String systemId, boolean modRewriteStyleConf)

  • Method Details

    • loadDom

      protected void loadDom(InputStream inputStream)
      Replaces Tuckey's parser. A secure parser cannot be configured by calling super.loadDom: that method builds its own factory and resolver.

      Called from the superclass constructor. Uses only static state.

      Overrides:
      loadDom in class org.tuckey.web.filters.urlrewrite.Conf