Add processExternalEntities support to OXM

Update OXM AbstractMarshaller to support processing of external
XML entities. By default external entities will not be processed.

Issue: SPR-11376

spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverter.java

@@ -28,6 +28,8 @@ import javax.xml.bind.annotation.XmlRootElement;
 import javax.xml.bind.annotation.XmlType;
 import javax.xml.transform.Result;
 import javax.xml.transform.Source;
+import javax.xml.transform.sax.SAXSource;
+import javax.xml.transform.stream.StreamSource;
 
 import org.springframework.core.annotation.AnnotationUtils;
 import org.springframework.http.HttpHeaders;
@@ -36,6 +38,10 @@ import org.springframework.http.converter.HttpMessageConversionException;
 import org.springframework.http.converter.HttpMessageNotReadableException;
 import org.springframework.http.converter.HttpMessageNotWritableException;
 import org.springframework.util.ClassUtils;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+import org.xml.sax.XMLReader;
+import org.xml.sax.helpers.XMLReaderFactory;
 
 /**
  * Implementation of {@link org.springframework.http.converter.HttpMessageConverter HttpMessageConverter} that can read
@@ -49,6 +55,18 @@ import org.springframework.util.ClassUtils;
  */
 public class Jaxb2RootElementHttpMessageConverter extends AbstractJaxb2HttpMessageConverter<Object> {
 
+		private boolean processExternalEntities = false;
+
+
+	/**
+	 * Indicates whether external XML entities are processed when converting to a Source.
+	 * <p>Default is {@code false}, meaning that external entities are not resolved.
+	 */
+	public void setProcessExternalEntities(boolean processExternalEntities) {
+		this.processExternalEntities = processExternalEntities;
+	}
+
+
 	@Override
 	public boolean canRead(Class<?> clazz, MediaType mediaType) {
 		return (clazz.isAnnotationPresent(XmlRootElement.class) || clazz.isAnnotationPresent(XmlType.class)) &&
@@ -69,6 +87,7 @@ public class Jaxb2RootElementHttpMessageConverter extends AbstractJaxb2HttpMessa
 	@Override
 	protected Object readFromSource(Class<?> clazz, HttpHeaders headers, Source source) throws IOException {
 		try {
+			source = processSource(source);
 			Unmarshaller unmarshaller = createUnmarshaller(clazz);
 			if (clazz.isAnnotationPresent(XmlRootElement.class)) {
 				return unmarshaller.unmarshal(source);
@@ -87,6 +106,26 @@ public class Jaxb2RootElementHttpMessageConverter extends AbstractJaxb2HttpMessa
 		}
 	}
 
+	protected Source processSource(Source source) {
+		if (source instanceof StreamSource) {
+			StreamSource streamSource = (StreamSource) source;
+			InputSource inputSource = new InputSource(streamSource.getInputStream());
+			try {
+				XMLReader xmlReader = XMLReaderFactory.createXMLReader();
+				String featureName = "http://xml.org/sax/features/external-general-entities";
+				xmlReader.setFeature(featureName, this.processExternalEntities);
+				return new SAXSource(xmlReader, inputSource);
+			}
+			catch (SAXException ex) {
+				logger.warn("Processing of external entities could not be disabled", ex);
+				return source;
+			}
+		}
+		else {
+			return source;
+		}
+	}
+
 	@Override
 	protected void writeToResult(Object o, HttpHeaders headers, Result result) throws IOException {
 		try {

spring-web/src/main/java/org/springframework/http/converter/xml/SourceHttpMessageConverter.java

@@ -90,6 +90,12 @@ public class SourceHttpMessageConverter<T extends Source> extends AbstractHttpMe
 		this.processExternalEntities = processExternalEntities;
 	}
 
+	/**
+	 * @return the configured value for whether XML external entities are allowed.
+	 */
+	public boolean isProcessExternalEntities() {
+		return this.processExternalEntities;
+	}
 
 	@Override
 	public boolean supports(Class<?> clazz) {

spring-web/src/test/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverterTest.java

@@ -32,6 +32,8 @@ import org.junit.Test;
 import org.springframework.aop.framework.AdvisedSupport;
 import org.springframework.aop.framework.AopProxy;
 import org.springframework.aop.framework.DefaultAopProxyFactory;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.MockHttpInputMessage;
 import org.springframework.http.MockHttpOutputMessage;
@@ -95,6 +97,33 @@ public class Jaxb2RootElementHttpMessageConverterTest {
 		assertEquals("Invalid result", "Hello World", result.s);
 	}
 
+	@Test
+	public void readXmlRootElementExternalEntityDisabled() throws Exception {
+		Resource external = new ClassPathResource("external.txt", getClass());
+		String content =  "<!DOCTYPE root [" +
+				"  <!ELEMENT external ANY >\n" +
+				"  <!ENTITY ext SYSTEM \"" + external.getURI() + "\" >]>" +
+				"  <rootElement><external>&ext;</external></rootElement>";
+		MockHttpInputMessage inputMessage = new MockHttpInputMessage(content.getBytes("UTF-8"));
+		RootElement rootElement = (RootElement) converter.read(RootElement.class, inputMessage);
+
+		assertEquals("", rootElement.external);
+	}
+
+	@Test
+	public void readXmlRootElementExternalEntityEnabled() throws Exception {
+		Resource external = new ClassPathResource("external.txt", getClass());
+		String content =  "<!DOCTYPE root [" +
+				"  <!ELEMENT external ANY >\n" +
+				"  <!ENTITY ext SYSTEM \"" + external.getURI() + "\" >]>" +
+				"  <rootElement><external>&ext;</external></rootElement>";
+		MockHttpInputMessage inputMessage = new MockHttpInputMessage(content.getBytes("UTF-8"));
+		this.converter.setProcessExternalEntities(true);
+		RootElement rootElement = (RootElement) converter.read(RootElement.class, inputMessage);
+
+		assertEquals("Foo Bar", rootElement.external);
+	}
+
 	@Test
 	public void writeXmlRootElement() throws Exception {
 		MockHttpOutputMessage outputMessage = new MockHttpOutputMessage();
@@ -121,6 +150,9 @@ public class Jaxb2RootElementHttpMessageConverterTest {
 		@XmlElement
 		public Type type = new Type();
 
+		@XmlElement(required=false)
+		public String external;
+
 	}
 
 	@XmlType