Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Defensive initialization of AsyncXMLInputFactory

Browse Source 
Aalto's InputFactoryImpl already disables loading of external entities
by default (property "javax.xml.stream.isSupportingExternalEntities").
This commit goes further by applying the same defensive measures as we
do elsewhere for XMLInputFactory, which disables DTD completely.
Arguably there is no good reason to enable that by default in WebFlux.
This commit is contained in:
Rossen Stoyanchev
2019-01-04 22:18:15 -05:00
parent f52f3a2f35
commit 673a20cb10
2 changed files with 18 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
spring-core/src/main/java/org/springframework/util/xml/StaxUtils.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2018 the original author or authors.
* Copyright 2002-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
package org.springframework.util.xml;
import java.util.List;
import java.util.function.Supplier;
import javax.xml.stream.XMLEventFactory;
import javax.xml.stream.XMLEventReader;
import javax.xml.stream.XMLEventWriter;
@@ -58,11 +59,21 @@ public abstract class StaxUtils {
/**
* Create an {@link XMLInputFactory} with Spring's defensive setup,
* i.e. no support for the resolution of DTDs and external entities.
* @return a new input factory to use
* @return a new defensively initialized input factory instance to use
* @since 5.0
*/
public static XMLInputFactory createDefensiveInputFactory() {
XMLInputFactory inputFactory = XMLInputFactory.newInstance();
return createDefensiveInputFactory(XMLInputFactory::newFactory);
}
/**
* Variant of {@link #createDefensiveInputFactory()} with a custom instance.
* @param instanceSupplier supplier for the input factory instance
* @return a new defensively initialized input factory instance to use
* @since 5.0.12
*/
public static <T extends XMLInputFactory> T createDefensiveInputFactory(Supplier<T> instanceSupplier) {
T inputFactory = instanceSupplier.get();
inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
inputFactory.setXMLResolver(NO_OP_XML_RESOLVER);