This is an automated email from the ASF dual-hosted git repository.
andy pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/jena.git
The following commit(s) were added to refs/heads/main by this push:
new 290fcc1566 Revert JenaXMLInput
290fcc1566 is described below
commit 290fcc15661340fd5215471968216587f5b42027
Author: Andy Seaborne <[email protected]>
AuthorDate: Sat Apr 16 10:49:50 2022 +0100
Revert JenaXMLInput
---
.../java/org/apache/jena/util/JenaXMLInput.java | 69 +++++-----------------
1 file changed, 16 insertions(+), 53 deletions(-)
diff --git a/jena-core/src/main/java/org/apache/jena/util/JenaXMLInput.java
b/jena-core/src/main/java/org/apache/jena/util/JenaXMLInput.java
index 15a8757bd1..c7548d72b2 100644
--- a/jena-core/src/main/java/org/apache/jena/util/JenaXMLInput.java
+++ b/jena-core/src/main/java/org/apache/jena/util/JenaXMLInput.java
@@ -36,75 +36,43 @@ import org.xml.sax.XMLReader;
/**
* Create XML input methods.
- * <p>
- * External DTD and entity processing is disabled to prevent
+ * External DTD processing is disabled and will be silently ignored to prevent
* <a
href="https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing">XXE
Processing</a>
* problems.
- * <p>
- * DTDs are, by default, not processed. These may be enabled with {@link
#allowLocalDTDs}.
*/
public class JenaXMLInput {
// ---- SAX
// RDFXMLParser
private static SAXParserFactory saxParserFactory =
SAXParserFactory.newInstance();
- /** Whether to allow DTD processing. This applies to reading RDF/XML
- * and SPARQL XML Results - these formats do not need DTD processing
- * to be read into Jena.
- * <p>
- * External DTDs are always prohibited.
- * <p>
- * The default configuration is to not process DTDs.
- * An application may enable local DTD processing if necessary.
- *
- * @deprecated Future releases remove the ability to enable local DTDs
processing.
- */
- @Deprecated
- public static boolean allowLocalDTDs = false;
-
public static XMLReader createXMLReader() throws
ParserConfigurationException, SAXException {
SAXParser saxParser = saxParserFactory.newSAXParser();
XMLReader xmlreader = saxParser.getXMLReader();
- if ( !allowLocalDTDs ) {
- // XXE : disable all DTD processing.
- // Effect: JenaException if a DTD is found.
-
xmlreader.setFeature("http://apache.org/xml/features/disallow-doctype-decl";,
true);
- }
- // Always disable remote DTDs (silently ignore if DTDs are allowed
at all)
-
xmlreader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd";,
false);
- // and ignore external entities (silently ignore)
+ // XXE : either disable all DTD processing ...
+// // EFFECT: RIOT Error if DTD.
+//
xmlreader.setFeature("http://apache.org/xml/features/disallow-doctype-decl";,
true);
+// // This may not be strictly required as DTDs shouldn't be
allowed at all, per previous line.
+//
xmlreader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd";,
false);
+
+ // ... just ignore external DTDs (silently ignore)
xmlreader.setFeature("http://xml.org/sax/features/external-general-entities";,
false);
xmlreader.setFeature("http://xml.org/sax/features/external-parameter-entities";,
false);
return xmlreader;
- // WAS: only:
-//
xmlreader.setFeature("http://xml.org/sax/features/external-general-entities";,
false);
-//
xmlreader.setFeature("http://xml.org/sax/features/external-parameter-entities";,
false);
}
-
// ---- StAX
// TriX and results.
private static XMLInputFactory xf = XMLInputFactory.newInstance() ;
-
static {
try {
- if ( !allowLocalDTDs ) {
- // This disables DTDs entirely for that factory.
- // DTDs are silently ignored.
- xf.setProperty(XMLInputFactory.SUPPORT_DTD, false);
- }
- // Disable external DTDs (files and HTTP) - silent ignore.
- xf.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- // disable external entities (silently ignore)
- xf.setProperty("javax.xml.stream.isSupportingExternalEntities",
false);
-// // WAS only:
-// comment out -- xf.setProperty(XMLInputFactory.SUPPORT_DTD,
false);
-// xf.setProperty("javax.xml.stream.isSupportingExternalEntities",
false);
-
- } catch(IllegalArgumentException ex){
- Log.error(JenaXMLInput.class, "Problem setting StAX property", ex);
- }
+ // // This disables DTDs entirely for that factory
+ // xf.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+ // disable external entities (silently ignore)
+ xf.setProperty("javax.xml.stream.isSupportingExternalEntities",
false);
+ } catch(IllegalArgumentException ex){
+ Log.error(JenaXMLInput.class, "Problem setting StAX property", ex);
+ }
}
public static XMLStreamReader newXMLStreamReader(InputStream in) throws
XMLStreamException {
@@ -124,16 +92,11 @@ public class JenaXMLInput {
return factory;
}
-// // For reference : jdom:
+ // For reference : jdom:
// // ---- SAXBuilder
// public static SAXBuilder newSAXBuilder() throws
ParserConfigurationException {
// SAXBuilder builder = new SAXBuilder();
-// if ( !allowLocalDTDs ) {
-// // XXE : either disable all DTD processing ...
-//
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl";,
true);
-// }
//
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl",true);
-//
builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd";,
false;)
//
builder.setFeature("http://xml.org/sax/features/external-general-entities";,
false);
//
builder.setFeature("http://xml.org/sax/features/external-parameter-entities";,
false);
// builder.setExpandEntities(false);
