Package org.craftercms.commons.xml

Class XmlSecurityUtils

java.lang.Object

org.craftercms.commons.xml.XmlSecurityUtils

public final class XmlSecurityUtils
extends Object

Factories for XML parsers hardened against XXE and related attacks.

Returned parser instances are not thread-safe and must not be cached or shared across threads. Create a new instance for each parse operation.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	DECLARATION_HANDLER
static final String	DISALLOW_DOCTYPE_DECL
static final String	ENTITY_EXPANSION_LIMIT
static final String	EXTERNAL_GENERAL_ENTITIES
static final String	EXTERNAL_PARAMETER_ENTITIES
static final String	LOAD_EXTERNAL_DTD

Method Summary

Modifier and Type	Method	Description
static DocumentBuilder	createDocumentBuilder()	Creates a JAXP DocumentBuilder that rejects DOCTYPE declarations and external entities.
static org.dom4j.io.SAXReader	createSaxReader()	Creates a dom4j SAXReader that rejects DOCTYPE declarations and external entities.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DISALLOW_DOCTYPE_DECL

public static final String DISALLOW_DOCTYPE_DECL

See Also:

• Constant Field Values

EXTERNAL_GENERAL_ENTITIES

public static final String EXTERNAL_GENERAL_ENTITIES

See Also:

• Constant Field Values

EXTERNAL_PARAMETER_ENTITIES

public static final String EXTERNAL_PARAMETER_ENTITIES

See Also:

• Constant Field Values

LOAD_EXTERNAL_DTD

public static final String LOAD_EXTERNAL_DTD

See Also:

• Constant Field Values

DECLARATION_HANDLER

public static final String DECLARATION_HANDLER

See Also:

• Constant Field Values

ENTITY_EXPANSION_LIMIT

public static final String ENTITY_EXPANSION_LIMIT

See Also:

• Constant Field Values

Method Details

createDocumentBuilder

public static DocumentBuilder createDocumentBuilder()
                                             throws ParserConfigurationException

Creates a JAXP DocumentBuilder that rejects DOCTYPE declarations and external entities.

Returns:

a hardened document builder

Throws:

ParserConfigurationException - if the parser cannot be configured securely

createSaxReader

public static org.dom4j.io.SAXReader createSaxReader()
                                              throws SAXException

Creates a dom4j SAXReader that rejects DOCTYPE declarations and external entities.

Returns:

a hardened SAX reader

Throws:

SAXException - if a security feature cannot be configured