Top Description Fields Constructors Methods

org.wildfly.common.xml

pack-priv final Class FactoryConstants

Class Inheritance

extends Object

java.lang.Object
org.wildfly.common.xml.FactoryConstants

Constants to configure the factories. OWASP XML External Entity Prevention Cheatsheet

Author: Boris Unckel
Since: 1.6.0.Final

Field Summary

Modifier and Type	Field and Description
public static final String	APACHE_DISALLOW_DOCTYPE_DECL This is the PRIMARY defense.
public static final String	APACHE_LOAD_EXTERNAL_DTD Disable external DTDs as well.
public static final String	XML_EXTERNAL_GENERAL_ENTITIES If you can't completely disable DTDs, then at least do the following.
public static final String	XML_EXTERNAL_PARAMETER_ENTITIES This feature has to be used together with the previous one(external-general-entities), otherwise it will not protect you from XXE for sure Do not include external parameter entities or the external DTD subset.

Constructor Summary

Access	Constructor and Description
private	FactoryConstants() No instance.

Method Summary

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

APACHE_DISALLOW_DOCTYPE_DECL	back to summary
public static final String APACHE_DISALLOW_DOCTYPE_DECL This is the PRIMARY defense. If DTDs (doctypes) are disallowed, almost all XML entity attacks are prevented Xerces 2 only:

APACHE_LOAD_EXTERNAL_DTD	back to summary
public static final String APACHE_LOAD_EXTERNAL_DTD Disable external DTDs as well.

XML_EXTERNAL_GENERAL_ENTITIES	back to summary
public static final String XML_EXTERNAL_GENERAL_ENTITIES If you can't completely disable DTDs, then at least do the following. This feature has to be used together with the following one (external-parameter-entities), otherwise it will not protect you from XXE for sure Do not include external general entities. Xerces 1:

XML_EXTERNAL_PARAMETER_ENTITIES	back to summary
public static final String XML_EXTERNAL_PARAMETER_ENTITIES This feature has to be used together with the previous one(external-general-entities), otherwise it will not protect you from XXE for sure Do not include external parameter entities or the external DTD subset.

Constructor Detail

FactoryConstants	back to summary
private FactoryConstants() No instance.