[utilities COMMIT] in /java-support/trunk/src: main/java/net/shibboleth/utilities/java/support/xml/BasicParserPool.ja...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Feb 14 21:06:17 2014
New Revision: 531

URL: http://svn.shibboleth.net/view/utilities?rev=531&view=rev
Log:
JSPT-38: Port forward XEE changes from v2 JXT-105.

Modified:
    java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/xml/BasicParserPool.java
    java-support/trunk/src/test/java/net/shibboleth/utilities/java/support/xml/BasicParserPoolTest.java

Modified: java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/xml/BasicParserPool.java
URL: http://svn.shibboleth.net/view/utilities/java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/xml/BasicParserPool.java?rev=531&r1=530&r2=531&view=diff
==============================================================================
--- java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/xml/BasicParserPool.java (original)
+++ java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/xml/BasicParserPool.java Fri Feb 14 21:06:17 2014
@@ -30,6 +30,7 @@
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.annotation.concurrent.ThreadSafe;
+import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
@@ -132,8 +133,8 @@
         builderPool = new Stack<SoftReference<DocumentBuilder>>();
         builderAttributes = Collections.emptyMap();
         coalescing = true;
-        expandEntityReferences = true;
-        builderFeatures = Collections.emptyMap();
+        expandEntityReferences = false;
+        builderFeatures = buildDefaultFeatures();
         ignoreComments = true;
         ignoreElementContentWhitespace = true;
         namespaceAware = true;
@@ -584,6 +585,28 @@
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
     }
+    
+    /**
+     * Build the default set of parser features to use.
+     * 
+     * <p>These will be overriden by a call to {@link #setBuilderFeatures(Map)}.</p>
+     * 
+     * <p>
+     * The default features set are:
+     * <ul>
+     * <li>{@link XMLConstants#FEATURE_SECURE_PROCESSING} = true</li>
+     * <li>http://apache.org/xml/features/disallow-doctype-decl = true</li>
+     * </ul>
+     * </p>
+     * 
+     * @return the default features map
+     */
+    protected Map<String, Boolean> buildDefaultFeatures() {
+        HashMap<String, Boolean> features = new HashMap<String, Boolean>();
+        features.put(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        features.put("http://apache.org/xml/features/disallow-doctype-decl", true);
+        return features;
+    }
 
     /** A proxy that prevents the manages document builders retrieved from the parser pool. */
     protected class DocumentBuilderProxy extends DocumentBuilder {

Modified: java-support/trunk/src/test/java/net/shibboleth/utilities/java/support/xml/BasicParserPoolTest.java
URL: http://svn.shibboleth.net/view/utilities/java-support/trunk/src/test/java/net/shibboleth/utilities/java/support/xml/BasicParserPoolTest.java?rev=531&r1=530&r2=531&view=diff
==============================================================================
--- java-support/trunk/src/test/java/net/shibboleth/utilities/java/support/xml/BasicParserPoolTest.java (original)
+++ java-support/trunk/src/test/java/net/shibboleth/utilities/java/support/xml/BasicParserPoolTest.java Fri Feb 14 21:06:17 2014
@@ -146,7 +146,8 @@
         basicParserPool.initialize();
 
         Assert.assertTrue(basicParserPool.getBuilderAttributes().isEmpty(), "Checking attributes");
-        Assert.assertTrue(basicParserPool.getBuilderFeatures().isEmpty(), "Checking features");
+        // This is false because we now default in certain security-related features
+        Assert.assertFalse(basicParserPool.getBuilderFeatures().isEmpty(), "Checking features");
 
         Assert.assertFalse(basicParserPool.isCoalescing(), "pool Coalescing");