1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
From: Markus Koschany <apo@gambaru.de>
Date: Thu, 5 Dec 2013 10:59:47 +0100
Subject: Add 'processExternalEntities to JAXB2Marshaller
Added 'processExternalEntities' property to the JAXB2Marshaller, which
indicates whether external XML entities are processed when
unmarshalling.
Default is false, meaning that external entities are not resolved.
Processing of external entities will only be enabled/disabled when the
Source} passed to #unmarshal(Source) is a SAXSource or StreamSource. It
has no effect for DOMSource or StAXSource instances.
Original patch by Arjen Poutsma.
Bug: http://bugs.debian.org/720902
---
.../springframework/oxm/jaxb/Jaxb2Marshaller.java | 56 ++++++++++++++++++++++
1 file changed, 56 insertions(+)
diff --git a/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/jaxb/Jaxb2Marshaller.java b/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/jaxb/Jaxb2Marshaller.java
index 890ce18..1b3412d 100644
--- a/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/jaxb/Jaxb2Marshaller.java
+++ b/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/jaxb/Jaxb2Marshaller.java
@@ -61,7 +61,9 @@ import javax.xml.stream.XMLStreamReader;
import javax.xml.stream.XMLStreamWriter;
import javax.xml.transform.Result;
import javax.xml.transform.Source;
+import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.sax.SAXSource;
+import javax.xml.transform.stream.StreamSource;
import javax.xml.validation.Schema;
import javax.xml.validation.SchemaFactory;
@@ -158,6 +160,8 @@ public class Jaxb2Marshaller
private boolean lazyInit = false;
+ private boolean processExternalEntities = false;
+
/**
* Set multiple JAXB context paths. The given array of context paths is converted to a
@@ -301,6 +305,18 @@ public class Jaxb2Marshaller
this.lazyInit = lazyInit;
}
+ /**
+ * Indicates whether external XML entities are processed when unmarshalling.
+ * <p>Default is {@code false}, meaning that external entities are not resolved.
+ * Note that processing of external entities will only be enabled/disabled when the
+ * {@code Source} passed to {@link #unmarshal(Source)} is a {@link SAXSource} or
+ * {@link StreamSource}. It has no effect for {@link DOMSource} or {@link StAXSource}
+ * instances.
+ */
+ public void setProcessExternalEntities(boolean processExternalEntities) {
+ this.processExternalEntities = processExternalEntities;
+ }
+
public void setBeanClassLoader(ClassLoader classLoader) {
this.beanClassLoader = classLoader;
}
@@ -569,6 +585,8 @@ public class Jaxb2Marshaller
}
public Object unmarshal(Source source, MimeContainer mimeContainer) throws XmlMappingException {
+ source = processSource(source);
+
try {
Unmarshaller unmarshaller = createUnmarshaller();
if (this.mtomEnabled && mimeContainer != null) {
@@ -616,6 +634,44 @@ public class Jaxb2Marshaller
}
}
+ private Source processSource(Source source) {
+ if (StaxUtils.isStaxSource(source) || source instanceof DOMSource) {
+ return source;
+ }
+
+ XMLReader xmlReader = null;
+ InputSource inputSource = null;
+
+ if (source instanceof SAXSource) {
+ SAXSource saxSource = (SAXSource) source;
+ xmlReader = saxSource.getXMLReader();
+ inputSource = saxSource.getInputSource();
+ }
+ else if (source instanceof StreamSource) {
+ StreamSource streamSource = (StreamSource) source;
+ if (streamSource.getInputStream() != null) {
+ inputSource = new InputSource(streamSource.getInputStream());
+ }
+ else if (streamSource.getReader() != null) {
+ inputSource = new InputSource(streamSource.getReader());
+ }
+ }
+
+ try {
+ if (xmlReader == null) {
+ xmlReader = XMLReaderFactory.createXMLReader();
+ }
+ xmlReader.setFeature("http://xml.org/sax/features/external-general-entities",
+ this.processExternalEntities);
+
+ return new SAXSource(xmlReader, inputSource);
+ }
+ catch (SAXException ex) {
+ logger.warn("Processing of external entities could not be disabled", ex);
+ return source;
+ }
+ }
+
/**
* Template method that can be overridden by concrete JAXB marshallers for custom initialization behavior.
* Gets called after creation of JAXB <code>Marshaller</code>, and after the respective properties have been set.
|
