[java-xmltooling COMMIT] in /branches/REL_1: doc/RELEASE-NOTES.txt src/main/java/org/opensaml/xml/parse/BasicParserPo...

[noreply at shibboleth.net]

Author: putmanb
Date: Thu Dec 12 04:39:21 2013
New Revision: 812

URL: http://svn.shibboleth.net/view/java-xmltooling?rev=812&view=rev
Log:
JXT-105: DefaultBootstrap unexpectedly uses a parser StaticBasicParserPool with expandEntityReferences set to true

Modified:
    branches/REL_1/doc/RELEASE-NOTES.txt
    branches/REL_1/src/main/java/org/opensaml/xml/parse/BasicParserPool.java
    branches/REL_1/src/main/java/org/opensaml/xml/parse/StaticBasicParserPool.java

Modified: branches/REL_1/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/doc/RELEASE-NOTES.txt?rev=812&r1=811&r2=812&view=diff
==============================================================================
--- branches/REL_1/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_1/doc/RELEASE-NOTES.txt Thu Dec 12 04:39:21 2013
@@ -2,6 +2,7 @@
 =============================================
 [JXT-102] - Decrypter should be defensive about Santuario and Java crypto classes throwing unchecked exceptions 
 [JXT-103] - XMLTooling failed to pass veracode due Use of Wrong Operator in String Comparison (CWE ID 597) 
+[JXT-105] - DefaultBootstrap unexpectedly uses a parser StaticBasicParserPool with expandEntityReferences set to true
 
 Changes in Release 1.4.0
 =============================================

Modified: branches/REL_1/src/main/java/org/opensaml/xml/parse/BasicParserPool.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/parse/BasicParserPool.java?rev=812&r1=811&r2=812&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/xml/parse/BasicParserPool.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/xml/parse/BasicParserPool.java Thu Dec 12 04:39:21 2013
@@ -23,9 +23,11 @@
 import java.io.Reader;
 import java.lang.ref.SoftReference;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.Map;
 import java.util.Stack;
 
+import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
@@ -124,8 +126,8 @@
         builderPool = new Stack<SoftReference<DocumentBuilder>>();
         builderAttributes = new LazyMap<String, Object>();
         coalescing = true;
-        expandEntityReferences = true;
-        builderFeatures = new LazyMap<String, Boolean>();
+        expandEntityReferences = false;
+        builderFeatures = buildDefaultFeatures();
         ignoreComments = true;
         ignoreElementContentWhitespace = true;
         namespaceAware = true;
@@ -586,6 +588,28 @@
             throw new XMLParserException("Unable to create new document builder", e);
         }
     }
+    
+    /**
+     * Build the default set of parser features to use.
+     * 
+     * <p>These will be overriden by a call to {@link #setBuilderFeatures(Map)}.</p>
+     * 
+     * <p>
+     * The default features set are:
+     * <ul>
+     * <li>{@link XMLConstants#FEATURE_SECURE_PROCESSING} = true</li>
+     * <li>http://apache.org/xml/features/disallow-doctype-decl = true</li>
+     * </ul>
+     * </p>
+     * 
+     * @return the default features map
+     */
+    protected Map<String, Boolean> buildDefaultFeatures() {
+        HashMap<String, Boolean> features = new HashMap<String, Boolean>();
+        features.put(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        features.put("http://apache.org/xml/features/disallow-doctype-decl", true);
+        return features;
+    }
 
     /**
      * A proxy that prevents the manages document builders retrieved from the parser pool.

Modified: branches/REL_1/src/main/java/org/opensaml/xml/parse/StaticBasicParserPool.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/parse/StaticBasicParserPool.java?rev=812&r1=811&r2=812&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/xml/parse/StaticBasicParserPool.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/xml/parse/StaticBasicParserPool.java Thu Dec 12 04:39:21 2013
@@ -23,9 +23,11 @@
 import java.io.Reader;
 import java.lang.ref.SoftReference;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.Map;
 import java.util.Stack;
 
+import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
@@ -120,8 +122,8 @@
         builderPool = new Stack<SoftReference<DocumentBuilder>>();
         builderAttributes = new LazyMap<String, Object>();
         coalescing = true;
-        expandEntityReferences = true;
-        builderFeatures = new LazyMap<String, Boolean>();
+        expandEntityReferences = false;
+        builderFeatures = buildDefaultFeatures();
         ignoreComments = true;
         ignoreElementContentWhitespace = true;
         namespaceAware = true;
@@ -568,6 +570,28 @@

[... 29 lines stripped ...]