Skip to content

Commit 2c030d4

Browse files
Arjen Poutsmarstoyanchev
authored andcommitted
Added 'processExternalEntities' to JAXB2Marshaller
Added 'processExternalEntities' property to the JAXB2Marshaller, which indicates whether external XML entities are processed when unmarshalling. Default is false, meaning that external entities are not resolved. Processing of external entities will only be enabled/disabled when the Source} passed to #unmarshal(Source) is a SAXSource or StreamSource. It has no effect for DOMSource or StAXSource instances.
1 parent 3272917 commit 2c030d4

File tree

1 file changed

+56
-0
lines changed

1 file changed

+56
-0
lines changed

spring-oxm/src/main/java/org/springframework/oxm/jaxb/Jaxb2Marshaller.java

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,9 @@
6161
import javax.xml.stream.XMLStreamWriter;
6262
import javax.xml.transform.Result;
6363
import javax.xml.transform.Source;
64+
import javax.xml.transform.dom.DOMSource;
6465
import javax.xml.transform.sax.SAXSource;
66+
import javax.xml.transform.stream.StreamSource;
6567
import javax.xml.validation.Schema;
6668
import javax.xml.validation.SchemaFactory;
6769

@@ -173,6 +175,8 @@ public class Jaxb2Marshaller implements MimeMarshaller, MimeUnmarshaller, Generi
173175

174176
private Schema schema;
175177

178+
private boolean processExternalEntities = false;
179+
176180

177181
/**
178182
* Set multiple JAXB context paths. The given array of context paths gets
@@ -385,6 +389,18 @@ public void setMappedClass(Class<?> mappedClass) {
385389
this.mappedClass = mappedClass;
386390
}
387391

392+
/**
393+
* Indicates whether external XML entities are processed when unmarshalling.
394+
* <p>Default is {@code false}, meaning that external entities are not resolved.
395+
* Note that processing of external entities will only be enabled/disabled when the
396+
* {@code Source} passed to {@link #unmarshal(Source)} is a {@link SAXSource} or
397+
* {@link StreamSource}. It has no effect for {@link DOMSource} or {@link StAXSource}
398+
* instances.
399+
*/
400+
public void setProcessExternalEntities(boolean processExternalEntities) {
401+
this.processExternalEntities = processExternalEntities;
402+
}
403+
388404
@Override
389405
public void setBeanClassLoader(ClassLoader classLoader) {
390406
this.beanClassLoader = classLoader;
@@ -712,6 +728,8 @@ public Object unmarshal(Source source) throws XmlMappingException {
712728

713729
@Override
714730
public Object unmarshal(Source source, MimeContainer mimeContainer) throws XmlMappingException {
731+
source = processSource(source);
732+
715733
try {
716734
Unmarshaller unmarshaller = createUnmarshaller();
717735
if (this.mtomEnabled && mimeContainer != null) {
@@ -752,6 +770,44 @@ protected Object unmarshalStaxSource(Unmarshaller jaxbUnmarshaller, Source staxS
752770
}
753771
}
754772

773+
private Source processSource(Source source) {
774+
if (StaxUtils.isStaxSource(source) || source instanceof DOMSource) {
775+
return source;
776+
}
777+
778+
XMLReader xmlReader = null;
779+
InputSource inputSource = null;
780+
781+
if (source instanceof SAXSource) {
782+
SAXSource saxSource = (SAXSource) source;
783+
xmlReader = saxSource.getXMLReader();
784+
inputSource = saxSource.getInputSource();
785+
}
786+
else if (source instanceof StreamSource) {
787+
StreamSource streamSource = (StreamSource) source;
788+
if (streamSource.getInputStream() != null) {
789+
inputSource = new InputSource(streamSource.getInputStream());
790+
}
791+
else if (streamSource.getReader() != null) {
792+
inputSource = new InputSource(streamSource.getReader());
793+
}
794+
}
795+
796+
try {
797+
if (xmlReader == null) {
798+
xmlReader = XMLReaderFactory.createXMLReader();
799+
}
800+
xmlReader.setFeature("http://xml.org/sax/features/external-general-entities",
801+
this.processExternalEntities);
802+
803+
return new SAXSource(xmlReader, inputSource);
804+
}
805+
catch (SAXException ex) {
806+
logger.warn("Processing of external entities could not be disabled", ex);
807+
return source;
808+
}
809+
}
810+
755811
/**
756812
* Return a newly created JAXB unmarshaller.
757813
* Note: JAXB unmarshallers are not necessarily thread-safe.

0 commit comments

Comments
 (0)