Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add processExternalEntities support to OXM

Browse Source 
Update OXM AbstractMarshaller to support processing of external
XML entities. By default external entities will not be processed.

Issue: SPR-11376
This commit is contained in:
Rossen Stoyanchev
2014-02-18 15:48:02 -08:00
committed by Phillip Webb
parent 7efd54e243
commit edba32b309
13 changed files with 349 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
spring-web/src/test/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverterTests.java
View File

@@ -32,9 +32,13 @@ import org.junit.Test;
import org.springframework.aop.framework.AdvisedSupport;
import org.springframework.aop.framework.AopProxy;
import org.springframework.aop.framework.DefaultAopProxyFactory;
import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.Resource;
import org.springframework.http.MediaType;
import org.springframework.http.MockHttpInputMessage;
import org.springframework.http.MockHttpOutputMessage;
import org.springframework.http.converter.HttpMessageNotReadableException;
import org.xml.sax.SAXParseException;
/** @author Arjen Poutsma */
public class Jaxb2RootElementHttpMessageConverterTests {
@@ -95,6 +99,33 @@ public class Jaxb2RootElementHttpMessageConverterTests {
assertEquals("Invalid result", "Hello World", result.s);
}
@Test
public void readXmlRootElementExternalEntityDisabled() throws Exception {
Resource external = new ClassPathResource("external.txt", getClass());
String content = "<!DOCTYPE root [" +
" <!ELEMENT external ANY >\n" +
" <!ENTITY ext SYSTEM \"" + external.getURI() + "\" >]>" +
" <rootElement><external>&ext;</external></rootElement>";
MockHttpInputMessage inputMessage = new MockHttpInputMessage(content.getBytes("UTF-8"));
RootElement rootElement = (RootElement) converter.read(RootElement.class, inputMessage);
assertEquals("", rootElement.external);
}
@Test
public void readXmlRootElementExternalEntityEnabled() throws Exception {
Resource external = new ClassPathResource("external.txt", getClass());
String content = "<!DOCTYPE root [" +
" <!ELEMENT external ANY >\n" +
" <!ENTITY ext SYSTEM \"" + external.getURI() + "\" >]>" +
" <rootElement><external>&ext;</external></rootElement>";
MockHttpInputMessage inputMessage = new MockHttpInputMessage(content.getBytes("UTF-8"));
this.converter.setProcessExternalEntities(true);
RootElement rootElement = (RootElement) converter.read(RootElement.class, inputMessage);
assertEquals("Foo Bar", rootElement.external);
}
@Test
public void writeXmlRootElement() throws Exception {
MockHttpOutputMessage outputMessage = new MockHttpOutputMessage();
@@ -120,6 +151,9 @@ public class Jaxb2RootElementHttpMessageConverterTests {
private Type type = new Type();
@XmlElement(required=false)
public String external;
public Type getType() {
return this.type;
}