Author: uschindler
Date: Wed Aug 13 23:13:43 2014
New Revision: 1617854
URL: http://svn.apache.org/r1617854
Log:
Merged revision(s) 1617849 from poi/trunk:
More cleanups for bug #56814 and some more external entity leaks of #56164
Added:
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/util/DocumentHelper.java
- copied, changed from r1617849,
poi/trunk/src/ooxml/java/org/apache/poi/util/DocumentHelper.java
Modified:
poi/branches/REL_3_10_BRANCH/ (props changed)
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/util/SAXHelper.java
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/eventusermodel/ReadOnlySharedStringsTable.java
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFEventBasedExcelExtractor.java
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFExportToXml.java
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFImportFromXML.java
Propchange: poi/branches/REL_3_10_BRANCH/
------------------------------------------------------------------------------
Merged /poi/trunk:r1617849
Copied:
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/util/DocumentHelper.java
(from r1617849,
poi/trunk/src/ooxml/java/org/apache/poi/util/DocumentHelper.java)
URL:
http://svn.apache.org/viewvc/poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/util/DocumentHelper.java?p2=poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/util/DocumentHelper.java&p1=poi/trunk/src/ooxml/java/org/apache/poi/util/DocumentHelper.java&r1=1617849&r2=1617854&rev=1617854&view=diff
==============================================================================
--- poi/trunk/src/ooxml/java/org/apache/poi/util/DocumentHelper.java (original)
+++
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/util/DocumentHelper.java
Wed Aug 13 23:13:43 2014
@@ -53,7 +53,7 @@ public final class DocumentHelper {
static {
documentBuilderFactory.setNamespaceAware(true);
documentBuilderFactory.setValidating(false);
- trySetSAXFeature(documentBuilderFactory,
XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ trySetSAXFeature(documentBuilderFactory,
SAXHelper.FEATURE_SECURE_PROCESSING, true);
trySetXercesSecurityManager(documentBuilderFactory);
}
Modified:
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/util/SAXHelper.java
URL:
http://svn.apache.org/viewvc/poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/util/SAXHelper.java?rev=1617854&r1=1617853&r2=1617854&view=diff
==============================================================================
---
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/util/SAXHelper.java
(original)
+++
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/util/SAXHelper.java
Wed Aug 13 23:13:43 2014
@@ -25,9 +25,13 @@ import java.lang.reflect.Method;
import org.dom4j.Document;
import org.dom4j.DocumentException;
import org.dom4j.io.SAXReader;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParserFactory;
+
import org.xml.sax.EntityResolver;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
+import org.xml.sax.XMLReader;
/**
@@ -35,34 +39,47 @@ import org.xml.sax.SAXException;
*/
public final class SAXHelper {
private static POILogger logger = POILogFactory.getLogger(SAXHelper.class);
-
- // remove this constant once on Java 6 and stax-api.jar was removed (which
is missing this constant):
- private static final String FEATURE_SECURE_PROCESSING =
"http://javax.xml.XMLConstants/feature/secure-processing";;
-
+
+ private SAXHelper() {}
+
/**
- * Creates a new SAX Reader, with sensible defaults
+ * Creates a new SAX XMLReader, with sensible defaults
*/
- public static SAXReader getSAXReader() {
- SAXReader xmlReader = new SAXReader();
- xmlReader.setValidation(false);
- xmlReader.setEntityResolver(new EntityResolver() {
- public InputSource resolveEntity(String publicId, String systemId)
- throws SAXException, IOException {
- return new InputSource(new StringReader(""));
- }
- });
+ public static synchronized XMLReader newXMLReader() throws SAXException,
ParserConfigurationException {
+ XMLReader xmlReader = saxFactory.newSAXParser().getXMLReader();
+ xmlReader.setEntityResolver(IGNORING_ENTITY_RESOLVER);
trySetSAXFeature(xmlReader, FEATURE_SECURE_PROCESSING, true);
trySetXercesSecurityManager(xmlReader);
return xmlReader;
}
- private static void trySetSAXFeature(SAXReader xmlReader, String feature,
boolean enabled) {
+
+ static final EntityResolver IGNORING_ENTITY_RESOLVER = new
EntityResolver() {
+ // not in Java 5: @Override
+ public InputSource resolveEntity(String publicId, String systemId)
+ throws SAXException, IOException {
+ return new InputSource(new StringReader(""));
+ }
+ };
+
+ private static final SAXParserFactory saxFactory;
+ static {
+ saxFactory = SAXParserFactory.newInstance();
+ saxFactory.setValidating(false);
+ saxFactory.setNamespaceAware(true);
+ }
+
+ // remove this constant once on Java 6 and stax-api.jar was removed (which
is missing this constant):
+ static final String FEATURE_SECURE_PROCESSING =
"http://javax.xml.XMLConstants/feature/secure-processing";;
+
+ private static void trySetSAXFeature(XMLReader xmlReader, String feature,
boolean enabled) {
try {
xmlReader.setFeature(feature, enabled);
} catch (Exception e) {
logger.log(POILogger.INFO, "SAX Feature unsupported", feature, e);
}
}
- private static void trySetXercesSecurityManager(SAXReader xmlReader) {
+
+ private static void trySetXercesSecurityManager(XMLReader xmlReader) {
// Try built-in JVM one first, standalone if not
for (String securityManagerClassName : new String[] {
"com.sun.org.apache.xerces.internal.util.SecurityManager",
@@ -82,6 +99,21 @@ public final class SAXHelper {
}
/**
+ * Creates a new DOM4J SAXReader, with sensible defaults
+ */
+ public static SAXReader getSAXReader() throws DocumentException {
+ try {
+ SAXReader reader = new SAXReader(newXMLReader(), false);
+ reader.setEntityResolver(IGNORING_ENTITY_RESOLVER);
+ return reader;
+ } catch (SAXException saxe) {
+ throw new DocumentException(saxe);
+ } catch (ParserConfigurationException pce) {
+ throw new DocumentException(pce);
+ }
+ }
+
+ /**
* Parses the given stream via the default (sensible)
* SAX Reader
* @param inp Stream to read the XML data from
Modified:
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/eventusermodel/ReadOnlySharedStringsTable.java
URL:
http://svn.apache.org/viewvc/poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/eventusermodel/ReadOnlySharedStringsTable.java?rev=1617854&r1=1617853&r2=1617854&view=diff
==============================================================================
---
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/eventusermodel/ReadOnlySharedStringsTable.java
(original)
+++
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/eventusermodel/ReadOnlySharedStringsTable.java
Wed Aug 13 23:13:43 2014
@@ -22,12 +22,11 @@ import java.util.ArrayList;
import java.util.List;
import javax.xml.parsers.ParserConfigurationException;
-import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
import org.apache.poi.openxml4j.opc.OPCPackage;
import org.apache.poi.openxml4j.opc.PackagePart;
import org.apache.poi.openxml4j.opc.PackageRelationship;
+import org.apache.poi.util.SAXHelper;
import org.apache.poi.xssf.usermodel.XSSFRelation;
import org.openxmlformats.schemas.spreadsheetml.x2006.main.CTRst;
import org.xml.sax.Attributes;
@@ -135,10 +134,8 @@ public class ReadOnlySharedStringsTable
*/
public void readFrom(InputStream is) throws IOException, SAXException {
InputSource sheetSource = new InputSource(is);
- SAXParserFactory saxFactory = SAXParserFactory.newInstance();
try {
- SAXParser saxParser = saxFactory.newSAXParser();
- XMLReader sheetParser = saxParser.getXMLReader();
+ XMLReader sheetParser = SAXHelper.newXMLReader();
sheetParser.setContentHandler(this);
sheetParser.parse(sheetSource);
} catch(ParserConfigurationException e) {
Modified:
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFEventBasedExcelExtractor.java
URL:
http://svn.apache.org/viewvc/poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFEventBasedExcelExtractor.java?rev=1617854&r1=1617853&r2=1617854&view=diff
==============================================================================
---
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFEventBasedExcelExtractor.java
(original)
+++
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFEventBasedExcelExtractor.java
Wed Aug 13 23:13:43 2014
@@ -22,8 +22,6 @@ import java.util.List;
import java.util.Locale;
import javax.xml.parsers.ParserConfigurationException;
-import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
import org.apache.poi.POIXMLProperties;
import org.apache.poi.POIXMLTextExtractor;
@@ -33,6 +31,7 @@ import org.apache.poi.POIXMLProperties.E
import org.apache.poi.openxml4j.exceptions.OpenXML4JException;
import org.apache.poi.openxml4j.opc.OPCPackage;
import org.apache.poi.ss.usermodel.DataFormatter;
+import org.apache.poi.util.SAXHelper;
import org.apache.poi.xssf.eventusermodel.ReadOnlySharedStringsTable;
import org.apache.poi.xssf.eventusermodel.XSSFReader;
import org.apache.poi.xssf.eventusermodel.XSSFSheetXMLHandler;
@@ -154,10 +153,8 @@ public class XSSFEventBasedExcelExtracto
}
InputSource sheetSource = new InputSource(sheetInputStream);
- SAXParserFactory saxFactory = SAXParserFactory.newInstance();
try {
- SAXParser saxParser = saxFactory.newSAXParser();
- XMLReader sheetParser = saxParser.getXMLReader();
+ XMLReader sheetParser = SAXHelper.newXMLReader();
ContentHandler handler = new XSSFSheetXMLHandler(
styles, strings, sheetContentsExtractor, formatter,
formulasNotResults);
sheetParser.setContentHandler(handler);
Modified:
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFExportToXml.java
URL:
http://svn.apache.org/viewvc/poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFExportToXml.java?rev=1617854&r1=1617853&r2=1617854&view=diff
==============================================================================
---
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFExportToXml.java
(original)
+++
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFExportToXml.java
Wed Aug 13 23:13:43 2014
@@ -26,8 +26,6 @@ import java.util.List;
import java.util.Map;
import java.util.Vector;
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.transform.OutputKeys;
import javax.xml.transform.Source;
@@ -41,6 +39,7 @@ import javax.xml.validation.SchemaFactor
import javax.xml.validation.Validator;
import org.apache.poi.openxml4j.exceptions.InvalidFormatException;
+import org.apache.poi.util.DocumentHelper;
import org.apache.poi.xssf.usermodel.XSSFCell;
import org.apache.poi.xssf.usermodel.XSSFMap;
import org.apache.poi.xssf.usermodel.XSSFRow;
@@ -101,15 +100,6 @@ public class XSSFExportToXml implements
exportToXML(os, "UTF-8", validate);
}
- private Document getEmptyDocument() throws ParserConfigurationException{
-
- DocumentBuilderFactory dbfac = DocumentBuilderFactory.newInstance();
- DocumentBuilder docBuilder = dbfac.newDocumentBuilder();
- Document doc = docBuilder.newDocument();
-
- return doc;
- }
-
/**
* Exports the data in an XML stream
*
@@ -127,7 +117,7 @@ public class XSSFExportToXml implements
String rootElement = map.getCtMap().getRootElement();
- Document doc = getEmptyDocument();
+ Document doc = DocumentHelper.createDocument();
Element root = null;
Modified:
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFImportFromXML.java
URL:
http://svn.apache.org/viewvc/poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFImportFromXML.java?rev=1617854&r1=1617853&r2=1617854&view=diff
==============================================================================
---
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFImportFromXML.java
(original)
+++
poi/branches/REL_3_10_BRANCH/src/ooxml/java/org/apache/poi/xssf/extractor/XSSFImportFromXML.java
Wed Aug 13 23:13:43 2014
@@ -24,13 +24,13 @@ import java.util.List;
import javax.xml.namespace.NamespaceContext;
import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
import javax.xml.xpath.XPathExpressionException;
import javax.xml.xpath.XPathFactory;
+import org.apache.poi.util.DocumentHelper;
import org.apache.poi.util.POILogFactory;
import org.apache.poi.util.POILogger;
import org.apache.poi.xssf.usermodel.XSSFTable;
@@ -75,11 +75,9 @@ public class XSSFImportFromXML {
* @throws ParserConfigurationException if there are problems with XML
parser configuration
* @throws IOException if there are problems reading the input string
*/
- public void importFromXML(String xmlInputString) throws SAXException,
XPathExpressionException, ParserConfigurationException, IOException {
+ public void importFromXML(String xmlInputString) throws SAXException,
XPathExpressionException, IOException {
- DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
- factory.setNamespaceAware(true);
- DocumentBuilder builder = factory.newDocumentBuilder();
+ DocumentBuilder builder = DocumentHelper.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new
StringReader(xmlInputString.trim())));
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
