Tweak XmlInputFactory settings

spring-batch-infrastructure/src/main/java/org/springframework/batch/item/xml/StaxEventItemReader.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2007 the original author or authors.
+ * Copyright 2006-2019 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -54,6 +54,7 @@ import org.springframework.util.StringUtils;
  * The implementation is <b>not</b> thread-safe.
  * 
  * @author Robert Kasanicky
+ * @author Mahmoud Ben Hassine
  */
 public class StaxEventItemReader<T> extends AbstractItemCountingItemStreamItemReader<T> implements
 ResourceAwareItemReaderItemStream<T>, InitializingBean {
@@ -76,6 +77,8 @@ ResourceAwareItemReaderItemStream<T>, InitializingBean {
 
 	private boolean strict = true;
 
+	private XMLInputFactory xmlInputFactory = StaxUtils.createXmlInputFactory();
+
 	public StaxEventItemReader() {
 		setName(ClassUtils.getShortName(StaxEventItemReader.class));
 	}
@@ -118,6 +121,15 @@ ResourceAwareItemReaderItemStream<T>, InitializingBean {
 		}
 	}
 
+	/**
+	 * Set the {@link XMLInputFactory}.
+	 * @param xmlInputFactory to use
+	 */
+	public void setXmlInputFactory(XMLInputFactory xmlInputFactory) {
+		Assert.notNull(xmlInputFactory, "XMLInputFactory must not be null");
+		this.xmlInputFactory = xmlInputFactory;
+	}
+
 	/**
 	 * Ensure that all required dependencies for the ItemReader to run are provided after all properties have been set.
 	 * 
@@ -208,7 +220,7 @@ ResourceAwareItemReaderItemStream<T>, InitializingBean {
 		}
 
 		inputStream = resource.getInputStream();
-		eventReader = XMLInputFactory.newInstance().createXMLEventReader(inputStream);
+		eventReader = xmlInputFactory.createXMLEventReader(inputStream);
 		fragmentReader = new DefaultFragmentEventReader(eventReader);
 		noInput = false;
 

spring-batch-infrastructure/src/main/java/org/springframework/batch/item/xml/StaxUtils.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2006-2007 the original author or authors.
+ * Copyright 2006-2019 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ package org.springframework.batch.item.xml;
 
 import javax.xml.stream.XMLEventReader;
 import javax.xml.stream.XMLEventWriter;
+import javax.xml.stream.XMLInputFactory;
 import javax.xml.stream.XMLStreamException;
 import javax.xml.transform.Result;
 import javax.xml.transform.Source;
@@ -31,6 +32,7 @@ import javax.xml.transform.stax.StAXSource;
  * This class is thread-safe.
  *
  * @author Josh Long
+ * @author Mahmoud Ben Hassine
  *
  */
 public abstract class StaxUtils {
@@ -42,4 +44,11 @@ public abstract class StaxUtils {
 	public static Result getResult(XMLEventWriter w) {
 		return new StAXResult(w);
 	}
+
+	public static XMLInputFactory createXmlInputFactory() {
+		XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
+		xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+		xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+		return xmlInputFactory;
+	}
 }

spring-batch-infrastructure/src/main/java/org/springframework/batch/item/xml/builder/StaxEventItemReaderBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2017 the original author or authors.
+ * Copyright 2017-2019 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,7 +19,10 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 
+import javax.xml.stream.XMLInputFactory;
+
 import org.springframework.batch.item.xml.StaxEventItemReader;
+import org.springframework.batch.item.xml.StaxUtils;
 import org.springframework.core.io.Resource;
 import org.springframework.oxm.Unmarshaller;
 import org.springframework.util.Assert;
@@ -50,6 +53,8 @@ public class StaxEventItemReaderBuilder<T> {
 
 	private int currentItemCount;
 
+	private XMLInputFactory xmlInputFactory = StaxUtils.createXmlInputFactory();
+
 	/**
 	 * Configure if the state of the {@link org.springframework.batch.item.ItemStreamSupport}
 	 * should be persisted within the {@link org.springframework.batch.item.ExecutionContext}
@@ -175,6 +180,19 @@ public class StaxEventItemReaderBuilder<T> {
 		return this;
 	}
 
+	/**
+	 * Set the {@link XMLInputFactory}.
+	 *
+	 * @param xmlInputFactory to use
+	 * @return The current instance of the builder
+	 * @see StaxEventItemReader#setXmlInputFactory(XMLInputFactory)
+	 */
+	public StaxEventItemReaderBuilder<T> xmlInputFactory(XMLInputFactory xmlInputFactory) {
+		this.xmlInputFactory = xmlInputFactory;
+
+		return this;
+	}
+
 	/**
 	 * Validates the configuration and builds a new {@link StaxEventItemReader}
 	 *
@@ -203,6 +221,7 @@ public class StaxEventItemReaderBuilder<T> {
 		reader.setUnmarshaller(this.unmarshaller);
 		reader.setCurrentItemCount(this.currentItemCount);
 		reader.setMaxItemCount(this.maxItemCount);
+		reader.setXmlInputFactory(this.xmlInputFactory);
 
 		return reader;
 	}