From 6b8a289ad3029165c1d4d1c4b6cc47957c951707 Mon Sep 17 00:00:00 2001
From: Arjen Poutsma <apoutsma@gopivotal.com>
Date: Wed, 24 Jul 2013 09:54:22 +0200
Subject: [PATCH] Added properties to disable entity resolution.

---
 .../ws/pox/dom/DomPoxMessageFactory.java       | 17 +++++++++++++----
 .../endpoint/AbstractDomPayloadEndpoint.java   | 18 +++++++++++++++---
 2 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/core/src/main/java/org/springframework/ws/pox/dom/DomPoxMessageFactory.java b/core/src/main/java/org/springframework/ws/pox/dom/DomPoxMessageFactory.java
index 9425f5b7..84e6ef79 100644
--- a/core/src/main/java/org/springframework/ws/pox/dom/DomPoxMessageFactory.java
+++ b/core/src/main/java/org/springframework/ws/pox/dom/DomPoxMessageFactory.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2005-2010 the original author or authors.
+ * Copyright 2002-2013 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,13 +23,13 @@ import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.TransformerConfigurationException;
 
+import org.w3c.dom.Document;
+import org.xml.sax.SAXException;
+
 import org.springframework.util.Assert;
 import org.springframework.ws.WebServiceMessageFactory;
 import org.springframework.xml.transform.TransformerObjectSupport;
 
-import org.w3c.dom.Document;
-import org.xml.sax.SAXException;
-
 /**
  * Implementation of the {@link WebServiceMessageFactory} interface that creates a {@link DomPoxMessage}.
  *
@@ -49,6 +49,7 @@ public class DomPoxMessageFactory extends TransformerObjectSupport implements We
     public DomPoxMessageFactory() {
         documentBuilderFactory.setNamespaceAware(true);
         documentBuilderFactory.setValidating(false);
+	    documentBuilderFactory.setExpandEntityReferences(false);
     }
 
     /** Sets the content-type for the {@link DomPoxMessage}. */
@@ -67,6 +68,14 @@ public class DomPoxMessageFactory extends TransformerObjectSupport implements We
         documentBuilderFactory.setValidating(validating);
     }
 
+	/**
+	 * Set if the XML parser should expand entity reference nodes. Default is
+	 * {@code false}.
+	 */
+	public void setExpandEntityReferences(boolean expandEntityRef) {
+		documentBuilderFactory.setExpandEntityReferences(expandEntityRef);
+	}
+
     public DomPoxMessage createWebServiceMessage() {
         try {
             DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
diff --git a/core/src/main/java/org/springframework/ws/server/endpoint/AbstractDomPayloadEndpoint.java b/core/src/main/java/org/springframework/ws/server/endpoint/AbstractDomPayloadEndpoint.java
index 0c0ba289..d52dd471 100644
--- a/core/src/main/java/org/springframework/ws/server/endpoint/AbstractDomPayloadEndpoint.java
+++ b/core/src/main/java/org/springframework/ws/server/endpoint/AbstractDomPayloadEndpoint.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2005-2010 the original author or authors.
+ * Copyright 2002-2013 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,12 +24,12 @@ import javax.xml.transform.TransformerException;
 import javax.xml.transform.dom.DOMResult;
 import javax.xml.transform.dom.DOMSource;
 
-import org.springframework.xml.transform.TransformerObjectSupport;
-
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
 
+import org.springframework.xml.transform.TransformerObjectSupport;
+
 /**
  * Abstract base class for endpoints that handle the message payload as DOM elements.
  * <p/>
@@ -54,6 +54,8 @@ public abstract class AbstractDomPayloadEndpoint extends TransformerObjectSuppor
 
     private boolean namespaceAware = true;
 
+	private boolean expandEntityReferences = false;
+
     private boolean alwaysTransform = false;
 
     /** Set whether or not the XML parser should be XML namespace aware. Default is <code>true</code>. */
@@ -66,6 +68,15 @@ public abstract class AbstractDomPayloadEndpoint extends TransformerObjectSuppor
         this.validating = validating;
     }
 
+	/**
+	 * Set if the XML parser should expand entity reference nodes. Default is
+	 * {@code false}.
+	 */
+	public void setExpandEntityReferences(boolean expandEntityRef) {
+		documentBuilderFactory.setExpandEntityReferences(expandEntityRef);
+	}
+
+
     /**
      * Set if the request {@link Source} should always be transformed into a new {@link DOMResult}.
      * <p/>
@@ -111,6 +122,7 @@ public abstract class AbstractDomPayloadEndpoint extends TransformerObjectSuppor
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         factory.setValidating(validating);
         factory.setNamespaceAware(namespaceAware);
+	    factory.setExpandEntityReferences(expandEntityReferences);
         return factory;
     }