|
61 | 61 | import javax.xml.stream.XMLStreamWriter;
|
62 | 62 | import javax.xml.transform.Result;
|
63 | 63 | import javax.xml.transform.Source;
|
| 64 | +import javax.xml.transform.dom.DOMSource; |
64 | 65 | import javax.xml.transform.sax.SAXSource;
|
| 66 | +import javax.xml.transform.stream.StreamSource; |
65 | 67 | import javax.xml.validation.Schema;
|
66 | 68 | import javax.xml.validation.SchemaFactory;
|
67 | 69 |
|
@@ -173,6 +175,8 @@ public class Jaxb2Marshaller implements MimeMarshaller, MimeUnmarshaller, Generi
|
173 | 175 |
|
174 | 176 | private Schema schema;
|
175 | 177 |
|
| 178 | + private boolean processExternalEntities = false; |
| 179 | + |
176 | 180 |
|
177 | 181 | /**
|
178 | 182 | * Set multiple JAXB context paths. The given array of context paths gets
|
@@ -385,6 +389,18 @@ public void setMappedClass(Class<?> mappedClass) {
|
385 | 389 | this.mappedClass = mappedClass;
|
386 | 390 | }
|
387 | 391 |
|
| 392 | + /** |
| 393 | + * Indicates whether external XML entities are processed when unmarshalling. |
| 394 | + * <p>Default is {@code false}, meaning that external entities are not resolved. |
| 395 | + * Note that processing of external entities will only be enabled/disabled when the |
| 396 | + * {@code Source} passed to {@link #unmarshal(Source)} is a {@link SAXSource} or |
| 397 | + * {@link StreamSource}. It has no effect for {@link DOMSource} or {@link StAXSource} |
| 398 | + * instances. |
| 399 | + */ |
| 400 | + public void setProcessExternalEntities(boolean processExternalEntities) { |
| 401 | + this.processExternalEntities = processExternalEntities; |
| 402 | + } |
| 403 | + |
388 | 404 | @Override
|
389 | 405 | public void setBeanClassLoader(ClassLoader classLoader) {
|
390 | 406 | this.beanClassLoader = classLoader;
|
@@ -712,6 +728,8 @@ public Object unmarshal(Source source) throws XmlMappingException {
|
712 | 728 |
|
713 | 729 | @Override
|
714 | 730 | public Object unmarshal(Source source, MimeContainer mimeContainer) throws XmlMappingException {
|
| 731 | + source = processSource(source); |
| 732 | + |
715 | 733 | try {
|
716 | 734 | Unmarshaller unmarshaller = createUnmarshaller();
|
717 | 735 | if (this.mtomEnabled && mimeContainer != null) {
|
@@ -752,6 +770,44 @@ protected Object unmarshalStaxSource(Unmarshaller jaxbUnmarshaller, Source staxS
|
752 | 770 | }
|
753 | 771 | }
|
754 | 772 |
|
| 773 | + private Source processSource(Source source) { |
| 774 | + if (StaxUtils.isStaxSource(source) || source instanceof DOMSource) { |
| 775 | + return source; |
| 776 | + } |
| 777 | + |
| 778 | + XMLReader xmlReader = null; |
| 779 | + InputSource inputSource = null; |
| 780 | + |
| 781 | + if (source instanceof SAXSource) { |
| 782 | + SAXSource saxSource = (SAXSource) source; |
| 783 | + xmlReader = saxSource.getXMLReader(); |
| 784 | + inputSource = saxSource.getInputSource(); |
| 785 | + } |
| 786 | + else if (source instanceof StreamSource) { |
| 787 | + StreamSource streamSource = (StreamSource) source; |
| 788 | + if (streamSource.getInputStream() != null) { |
| 789 | + inputSource = new InputSource(streamSource.getInputStream()); |
| 790 | + } |
| 791 | + else if (streamSource.getReader() != null) { |
| 792 | + inputSource = new InputSource(streamSource.getReader()); |
| 793 | + } |
| 794 | + } |
| 795 | + |
| 796 | + try { |
| 797 | + if (xmlReader == null) { |
| 798 | + xmlReader = XMLReaderFactory.createXMLReader(); |
| 799 | + } |
| 800 | + xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", |
| 801 | + this.processExternalEntities); |
| 802 | + |
| 803 | + return new SAXSource(xmlReader, inputSource); |
| 804 | + } |
| 805 | + catch (SAXException ex) { |
| 806 | + logger.warn("Processing of external entities could not be disabled", ex); |
| 807 | + return source; |
| 808 | + } |
| 809 | + } |
| 810 | + |
755 | 811 | /**
|
756 | 812 | * Return a newly created JAXB unmarshaller.
|
757 | 813 | * Note: JAXB unmarshallers are not necessarily thread-safe.
|
|
0 commit comments