Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

XmlEventDecoder uses common defensive XMLInputFactory (now in StaxUtils)

Browse Source 
Issue: SPR-15797
This commit is contained in:
Juergen Hoeller
2017-07-20 13:17:27 +02:00
parent 40df7b6eca
commit e4651d6b50
5 changed files with 50 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
spring-web/src/main/java/org/springframework/http/codec/xml/XmlEventDecoder.java
View File

@@ -44,6 +44,7 @@ import org.springframework.lang.Nullable;
import org.springframework.util.ClassUtils;
import org.springframework.util.MimeType;
import org.springframework.util.MimeTypeUtils;
import org.springframework.util.xml.StaxUtils;
/**
* Decodes a {@link DataBuffer} stream into a stream of {@link XMLEvent}s.
@@ -77,7 +78,7 @@ import org.springframework.util.MimeTypeUtils;
*/
public class XmlEventDecoder extends AbstractDecoder<XMLEvent> {
private static final XMLInputFactory inputFactory = XMLInputFactory.newInstance();
private static final XMLInputFactory inputFactory = StaxUtils.createDefensiveInputFactory();
private static final boolean aaltoPresent = ClassUtils.isPresent(
"com.fasterxml.aalto.AsyncXMLStreamReader", XmlEventDecoder.class.getClassLoader());

27
spring-web/src/main/java/org/springframework/http/converter/json/Jackson2ObjectMapperBuilder.java
View File

@@ -26,8 +26,6 @@ import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.TimeZone;
import javax.xml.stream.XMLInputFactory;
import javax.xml.stream.XMLResolver;
import com.fasterxml.jackson.annotation.JsonFilter;
import com.fasterxml.jackson.annotation.JsonInclude;
@@ -62,8 +60,8 @@ import org.springframework.context.ApplicationContext;
import org.springframework.lang.Nullable;
import org.springframework.util.Assert;
import org.springframework.util.ClassUtils;
import org.springframework.util.StreamUtils;
import org.springframework.util.StringUtils;
import org.springframework.util.xml.StaxUtils;
/**
* A builder used to create {@link ObjectMapper} instances with a fluent API.
@@ -827,38 +825,27 @@ public class Jackson2ObjectMapperBuilder {
private static class XmlObjectMapperInitializer {
public ObjectMapper create() {
return new XmlMapper(xmlInputFactory());
return new XmlMapper(StaxUtils.createDefensiveInputFactory());
}
public ObjectMapper create(boolean defaultUseWrapper) {
JacksonXmlModule module = new JacksonXmlModule();
module.setDefaultUseWrapper(defaultUseWrapper);
return new XmlMapper(new XmlFactory(xmlInputFactory()), module);
return new XmlMapper(new XmlFactory(StaxUtils.createDefensiveInputFactory()), module);
}
private static XMLInputFactory xmlInputFactory() {
XMLInputFactory inputFactory = XMLInputFactory.newInstance();
inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
inputFactory.setXMLResolver(NO_OP_XML_RESOLVER);
return inputFactory;
}
private static final XMLResolver NO_OP_XML_RESOLVER = new XMLResolver() {
@Override
public Object resolveEntity(String publicID, String systemID, String base, String ns) {
return StreamUtils.emptyInput();
}
};
}
private static class SmileFactoryInitializer {
public JsonFactory create() {
return new SmileFactory();
}
}
private static class CborFactoryInitializer {
public JsonFactory create() {
return new CBORFactory();
}

23
spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2CollectionHttpMessageConverter.java
View File

@@ -31,7 +31,6 @@ import javax.xml.bind.Unmarshaller;
import javax.xml.bind.annotation.XmlRootElement;
import javax.xml.bind.annotation.XmlType;
import javax.xml.stream.XMLInputFactory;
import javax.xml.stream.XMLResolver;
import javax.xml.stream.XMLStreamException;
import javax.xml.stream.XMLStreamReader;
import javax.xml.transform.Result;
@@ -47,7 +46,7 @@ import org.springframework.http.converter.HttpMessageNotReadableException;
import org.springframework.http.converter.HttpMessageNotWritableException;
import org.springframework.lang.Nullable;
import org.springframework.util.ReflectionUtils;
import org.springframework.util.StreamUtils;
import org.springframework.util.xml.StaxUtils;
/**
* An {@code HttpMessageConverter} that can read XML collections using JAXB2.
@@ -242,25 +241,15 @@ public class Jaxb2CollectionHttpMessageConverter<T extends Collection>
}
/**
* Create a {@code XMLInputFactory} that this converter will use to create {@link
* javax.xml.stream.XMLStreamReader} and {@link javax.xml.stream.XMLEventReader} objects.
* Create an {@code XMLInputFactory} that this converter will use to create
* {@link javax.xml.stream.XMLStreamReader} and {@link javax.xml.stream.XMLEventReader}
* objects.
* <p>Can be overridden in subclasses, adding further initialization of the factory.
* The resulting factory is cached, so this method will only be called once.
* @see StaxUtils#createDefensiveInputFactory()
*/
protected XMLInputFactory createXmlInputFactory() {
XMLInputFactory inputFactory = XMLInputFactory.newInstance();
inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
inputFactory.setXMLResolver(NO_OP_XML_RESOLVER);
return inputFactory;
return StaxUtils.createDefensiveInputFactory();
}
private static final XMLResolver NO_OP_XML_RESOLVER = new XMLResolver() {
@Override
public Object resolveEntity(String publicID, String systemID, String base, String ns) {
return StreamUtils.emptyInput();
}
};
}

25
spring-web/src/main/java/org/springframework/http/converter/xml/SourceHttpMessageConverter.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2016 the original author or authors.
* Copyright 2002-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -66,7 +66,13 @@ import org.springframework.util.StreamUtils;
*/
public class SourceHttpMessageConverter<T extends Source> extends AbstractHttpMessageConverter<T> {
private static final Set<Class<?>> SUPPORTED_CLASSES = new HashSet<>(5);
private static final EntityResolver NO_OP_ENTITY_RESOLVER =
(publicId, systemId) -> new InputSource(new StringReader(""));
private static final XMLResolver NO_OP_XML_RESOLVER =
(publicID, systemID, base, ns) -> StreamUtils.emptyInput();
private static final Set<Class<?>> SUPPORTED_CLASSES = new HashSet<>(8);
static {
SUPPORTED_CLASSES.add(DOMSource.class);
@@ -279,19 +285,4 @@ public class SourceHttpMessageConverter<T extends Source> extends AbstractHttpMe
}
}
private static final EntityResolver NO_OP_ENTITY_RESOLVER = new EntityResolver() {
@Override
public InputSource resolveEntity(String publicId, String systemId) {
return new InputSource(new StringReader(""));
}
};
private static final XMLResolver NO_OP_XML_RESOLVER = new XMLResolver() {
@Override
public Object resolveEntity(String publicID, String systemID, String base, String ns) {
return StreamUtils.emptyInput();
}
};
}