XMLInputFactory with secure defaults set. Properties not supported generate a warning, but the
factory process creation will continue and return a result.
Settings based on recommendations of
Sonarcloud RSPEC-2755 and
OWASP XML
External Entity Prevention Cheatsheet.
javax.xml.stream.XMLInputFactory#SUPPORT_DTD is set to false.javax.xml.stream.XMLInputFactory#IS_SUPPORTING_EXTERNAL_ENTITIES is set to false.| Modifier and Type | Field and Description |
|---|---|
| private static final AtomicBoolean |
| Access | Constructor and Description |
|---|---|
| private |
| Modifier and Type | Method and Description |
|---|---|
| public static XMLInputFactory |
| TO_BE_LOGGED | back to summary |
|---|---|
| private static final AtomicBoolean TO_BE_LOGGED | |
| XMLInputFactoryUtil | back to summary |
|---|---|
| private XMLInputFactoryUtil() No instance. | |
| create | back to summary |
|---|---|
| public static XMLInputFactory create() Factory generated with secure defaults.
| |