Add processExternalEntities support to OXM

Update OXM AbstractMarshaller to support processing of external
XML entities. By default external entities will not be processed.

Issue: SPR-11376

spring-oxm/src/test/java/org/springframework/oxm/castor/CastorUnmarshallerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2013 the original author or authors.
+ * Copyright 2002-2014 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,8 @@ package org.springframework.oxm.castor;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.StringReader;
+import java.util.concurrent.atomic.AtomicReference;
+import javax.xml.transform.sax.SAXSource;
 import javax.xml.transform.stream.StreamSource;
 
 import org.junit.Ignore;
@@ -28,9 +30,13 @@ import org.springframework.core.io.ClassPathResource;
 import org.springframework.oxm.AbstractUnmarshallerTests;
 import org.springframework.oxm.MarshallingException;
 import org.springframework.oxm.Unmarshaller;
+import org.xml.sax.InputSource;
+import org.xml.sax.XMLReader;
 
+import static junit.framework.Assert.assertNotNull;
 import static org.hamcrest.CoreMatchers.*;
 import static org.junit.Assert.*;
+import static org.junit.Assert.assertEquals;
 
 /**
  * @author Arjen Poutsma
@@ -203,4 +209,59 @@ public class CastorUnmarshallerTests extends AbstractUnmarshallerTests {
 		StreamSource source = new StreamSource(new StringReader(xml));
 		return unmarshaller.unmarshal(source);
 	}
+
+	@Test
+	public void unmarshalStreamSourceExternalEntities() throws Exception {
+
+		final AtomicReference<XMLReader> result = new AtomicReference<XMLReader>();
+		CastorMarshaller marshaller = new CastorMarshaller() {
+			@Override
+			protected Object unmarshalSaxReader(XMLReader xmlReader, InputSource inputSource) {
+				result.set(xmlReader);
+				return null;
+			}
+		};
+
+		// 1. external-general-entities disabled (default)
+
+		marshaller.unmarshal(new StreamSource("1"));
+		assertNotNull(result.get());
+		assertEquals(false, result.get().getFeature("http://xml.org/sax/features/external-general-entities"));
+
+		// 2. external-general-entities disabled (default)
+
+		result.set(null);
+		marshaller.setProcessExternalEntities(true);
+		marshaller.unmarshal(new StreamSource("1"));
+		assertNotNull(result.get());
+		assertEquals(true, result.get().getFeature("http://xml.org/sax/features/external-general-entities"));
+	}
+
+	@Test
+	public void unmarshalSaxSourceExternalEntities() throws Exception {
+
+		final AtomicReference<XMLReader> result = new AtomicReference<XMLReader>();
+		CastorMarshaller marshaller = new CastorMarshaller() {
+			@Override
+			protected Object unmarshalSaxReader(XMLReader xmlReader, InputSource inputSource) {
+				result.set(xmlReader);
+				return null;
+			}
+		};
+
+		// 1. external-general-entities disabled (default)
+
+		marshaller.unmarshal(new SAXSource(new InputSource("1")));
+		assertNotNull(result.get());
+		assertEquals(false, result.get().getFeature("http://xml.org/sax/features/external-general-entities"));
+
+		// 2. external-general-entities disabled (default)
+
+		result.set(null);
+		marshaller.setProcessExternalEntities(true);
+		marshaller.unmarshal(new SAXSource(new InputSource("1")));
+		assertNotNull(result.get());
+		assertEquals(true, result.get().getFeature("http://xml.org/sax/features/external-general-entities"));
+	}
+
 }

spring-oxm/src/test/java/org/springframework/oxm/jaxb/Jaxb2MarshallerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2013 the original author or authors.
+ * Copyright 2002-2014 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,9 +31,12 @@ import javax.xml.bind.annotation.XmlType;
 import javax.xml.namespace.QName;
 import javax.xml.transform.Result;
 import javax.xml.transform.sax.SAXResult;
+import javax.xml.transform.sax.SAXSource;
 import javax.xml.transform.stream.StreamResult;
+import javax.xml.transform.stream.StreamSource;
 
 import org.junit.Test;
+import org.mockito.ArgumentCaptor;
 import org.mockito.InOrder;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.core.io.Resource;
@@ -47,9 +50,7 @@ import org.springframework.oxm.jaxb.test.ObjectFactory;
 import org.springframework.oxm.mime.MimeContainer;
 import org.springframework.util.FileCopyUtils;
 import org.springframework.util.ReflectionUtils;
-import org.xml.sax.Attributes;
-import org.xml.sax.ContentHandler;
-import org.xml.sax.Locator;
+import org.xml.sax.*;
 
 import static org.junit.Assert.*;
 import static org.custommonkey.xmlunit.XMLAssert.assertXMLEqual;
@@ -289,7 +290,7 @@ public class Jaxb2MarshallerTests extends AbstractMarshallerTests {
 	public void marshalAWrappedObjectHoldingAnXmlElementDeclElement() throws Exception {
 		// SPR-10714
 		marshaller = new Jaxb2Marshaller();
-		marshaller.setPackagesToScan(new String[] { "org.springframework.oxm.jaxb" });
+		marshaller.setPackagesToScan(new String[]{"org.springframework.oxm.jaxb"});
 		marshaller.afterPropertiesSet();
 		Airplane airplane = new Airplane();
 		airplane.setName("test");
@@ -300,6 +301,75 @@ public class Jaxb2MarshallerTests extends AbstractMarshallerTests {
 				writer.toString(), "<airplane><name>test</name></airplane>");
 	}
 
+	// SPR-10806
+
+	@Test
+	public void unmarshalStreamSourceExternalEntities() throws Exception {
+
+		final javax.xml.bind.Unmarshaller unmarshaller = mock(javax.xml.bind.Unmarshaller.class);
+		Jaxb2Marshaller marshaller = new Jaxb2Marshaller() {
+			@Override
+			protected javax.xml.bind.Unmarshaller createUnmarshaller() {
+				return unmarshaller;
+			}
+		};
+
+		// 1. external-general-entities disabled (default)
+
+		marshaller.unmarshal(new StreamSource("1"));
+		ArgumentCaptor<SAXSource> sourceCaptor = ArgumentCaptor.forClass(SAXSource.class);
+		verify(unmarshaller).unmarshal(sourceCaptor.capture());
+
+		SAXSource result = sourceCaptor.getValue();
+		assertEquals(false, result.getXMLReader().getFeature("http://xml.org/sax/features/external-general-entities"));
+
+		// 2. external-general-entities enabled
+
+		reset(unmarshaller);
+		marshaller.setProcessExternalEntities(true);
+
+		marshaller.unmarshal(new StreamSource("1"));
+		verify(unmarshaller).unmarshal(sourceCaptor.capture());
+
+		result = sourceCaptor.getValue();
+		assertEquals(true, result.getXMLReader().getFeature("http://xml.org/sax/features/external-general-entities"));
+	}
+
+	// SPR-10806
+
+	@Test
+	public void unmarshalSaxSourceExternalEntities() throws Exception {
+
+		final javax.xml.bind.Unmarshaller unmarshaller = mock(javax.xml.bind.Unmarshaller.class);
+		Jaxb2Marshaller marshaller = new Jaxb2Marshaller() {
+			@Override
+			protected javax.xml.bind.Unmarshaller createUnmarshaller() {
+				return unmarshaller;
+			}
+		};
+
+		// 1. external-general-entities disabled (default)
+
+		marshaller.unmarshal(new SAXSource(new InputSource("1")));
+		ArgumentCaptor<SAXSource> sourceCaptor = ArgumentCaptor.forClass(SAXSource.class);
+		verify(unmarshaller).unmarshal(sourceCaptor.capture());
+
+		SAXSource result = sourceCaptor.getValue();
+		assertEquals(false, result.getXMLReader().getFeature("http://xml.org/sax/features/external-general-entities"));
+
+		// 2. external-general-entities enabled
+
+		reset(unmarshaller);
+		marshaller.setProcessExternalEntities(true);
+
+		marshaller.unmarshal(new SAXSource(new InputSource("1")));
+		verify(unmarshaller).unmarshal(sourceCaptor.capture());
+
+		result = sourceCaptor.getValue();
+		assertEquals(true, result.getXMLReader().getFeature("http://xml.org/sax/features/external-general-entities"));
+	}
+
+
 	@XmlRootElement
 	@SuppressWarnings("unused")
 	public static class DummyRootElement {

spring-oxm/src/test/java/org/springframework/oxm/jibx/JibxMarshallerTests.java

@@ -16,21 +16,34 @@
 
 package org.springframework.oxm.jibx;
 
+import java.io.IOException;
 import java.io.StringWriter;
+import java.util.concurrent.atomic.AtomicReference;
+import javax.xml.transform.sax.SAXSource;
 import javax.xml.transform.stream.StreamResult;
+import javax.xml.transform.stream.StreamSource;
 
 import org.custommonkey.xmlunit.XMLUnit;
 import org.junit.BeforeClass;
 import org.junit.Test;
 
+import org.mockito.ArgumentCaptor;
 import org.springframework.oxm.AbstractMarshallerTests;
 import org.springframework.oxm.Marshaller;
+import org.springframework.oxm.XmlMappingException;
+import org.springframework.oxm.jaxb.Jaxb2Marshaller;
 import org.springframework.tests.Assume;
 import org.springframework.tests.TestGroup;
+import org.xml.sax.InputSource;
+import org.xml.sax.XMLReader;
 
 import static org.custommonkey.xmlunit.XMLAssert.*;
+import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.reset;
+import static org.mockito.Mockito.verify;
 
 /**
  * @author Arjen Poutsma
@@ -107,5 +120,4 @@ public class JibxMarshallerTests extends AbstractMarshallerTests {
 		assertFalse("JibxMarshaller supports illegal type", marshaller.supports(getClass()));
 	}
 
-
 }

spring-oxm/src/test/java/org/springframework/oxm/jibx/JibxUnmarshallerTests.java

@@ -28,7 +28,9 @@ import org.springframework.oxm.Unmarshaller;
 import org.springframework.tests.Assume;
 import org.springframework.tests.TestGroup;
 
-import static org.junit.Assert.*;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+
 
 /**
  * @author Arjen Poutsma