DocumentBuilderFactory with secure defaults set. Properties not supported generate a warning, but
the factory process creation will continue and return a result.
Settings based on recommendations of
Sonarcloud RSPEC-2755 and
OWASP XML
External Entity Prevention Cheatsheet.
javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING is set to true.javax.xml.XMLConstants#ACCESS_EXTERNAL_DTD is set to empty.javax.xml.XMLConstants#ACCESS_EXTERNAL_SCHEMA is set to empty.org.wildfly.common.xml.FactoryConstants#APACHE_DISALLOW_DOCTYPE_DECL is set to true.org.wildfly.common.xml.FactoryConstants#APACHE_LOAD_EXTERNAL_DTD is set to false.org.wildfly.common.xml.FactoryConstants#XML_EXTERNAL_GENERAL_ENTITIES is set to false.org.wildfly.common.xml.FactoryConstants#XML_EXTERNAL_PARAMETER_ENTITIES is set to false.javax.xml.parsers.DocumentBuilderFactory#setXIncludeAware(boolean) is set to false.javax.xml.parsers.DocumentBuilderFactory#setExpandEntityReferences(boolean) is set to false.| Modifier and Type | Field and Description |
|---|---|
| private static final AtomicBoolean |
| Access | Constructor and Description |
|---|---|
| private |
| Modifier and Type | Method and Description |
|---|---|
| public static DocumentBuilderFactory |
| TO_BE_LOGGED | back to summary |
|---|---|
| private static final AtomicBoolean TO_BE_LOGGED | |
| DocumentBuilderFactoryUtil | back to summary |
|---|---|
| private DocumentBuilderFactoryUtil() No instance. | |
| create | back to summary |
|---|---|
| public static DocumentBuilderFactory create() Factory generated with secure defaults.
| |