Package slash.common.helpers

Class SecureXml

java.lang.Object

slash.common.helpers.SecureXml

public class SecureXml
extends Object

XML parsing hardened against XXE and entity expansion attacks.

JAXB's Unmarshaller.unmarshal(InputStream|Reader|File|URL|InputSource) creates its own SAX parser which resolves external entities and external DTDs: a route file with a DOCTYPE can read local files into the converted output or make the server open network connections. Route formats (GPX, KML, RTZ, TCX, ...) never need a DOCTYPE, so it is rejected outright.

Author:

Christian Pesch

Method Summary

Modifier and Type	Method	Description
static jakarta.xml.bind.Unmarshaller	harden(jakarta.xml.bind.Unmarshaller unmarshaller)	Wraps the unmarshaller so every unmarshal(..) overload that would make JAXB create its own (unhardened) parser is routed through a hardened XMLReader instead.
static XMLInputFactory	harden(XMLInputFactory factory)
static SAXParser	newSaxParser()
static SAXParserFactory	newSaxParserFactory()
static XMLReader	newXmlReader()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

newSaxParserFactory

public static SAXParserFactory newSaxParserFactory()
                                            throws ParserConfigurationException,
SAXException

Throws:

ParserConfigurationException

SAXException

newSaxParser

public static SAXParser newSaxParser()
                              throws ParserConfigurationException,
SAXException

Throws:

ParserConfigurationException

SAXException

newXmlReader

public static XMLReader newXmlReader()
                              throws ParserConfigurationException,
SAXException

Throws:

ParserConfigurationException

SAXException

harden

public static XMLInputFactory harden(XMLInputFactory factory)

harden

public static jakarta.xml.bind.Unmarshaller harden(jakarta.xml.bind.Unmarshaller unmarshaller)

Wraps the unmarshaller so every unmarshal(..) overload that would make JAXB create its own (unhardened) parser is routed through a hardened XMLReader instead.