Piotr Karwasz created XALANJ-2851:
-------------------------------------
Summary: NPE when a SAXSource carries an XMLReader but no
InputSource
Key: XALANJ-2851
URL: https://issues.apache.org/jira/browse/XALANJ-2851
Project: XalanJ2
Issue Type: Bug
Security Level: No security risk; visible to anyone (Ordinary problems in
Xalan projects. Anybody can view the issue.)
Reporter: Piotr Karwasz
A {{SAXSource}} that carries an {{XMLReader}} and no {{InputSource}} makes both
TrAX implementations shipped in Xalan-J throw an undeclared
{{NullPointerException}} from {{Transformer.transform}}:
{noformat}
java.lang.NullPointerException: Cannot invoke
"org.xml.sax.InputSource.getSystemId()" because "xmlSource" is null
{noformat}
The reader is dereferenced defensively, the {{InputSource}} is not:
* {{org.apache.xml.dtm.ref.DTMManagerDefault.getDTM}}, lines 283-285
* {{org.apache.xalan.xsltc.dom.XSLTCDTMManager.getDTM}}, lines 333-335
both of which read:
{code:java}
xmlSource = SAXSource.sourceToInputSource(source);
String urlOfSource = xmlSource.getSystemId();
{code}
That {{SAXSource}} is well-formed: {{SAXSource}} has a no-argument constructor,
{{getInputSource()}} is documented to return {{null}}, and a reader that
generates its own events has no document to be told about.
It also arises without the caller building it, since
{{jakarta.xml.bind.helpers.AbstractUnmarshallerImpl.unmarshal(SAXSource)}}
hands {{source.getInputSource()}} straight to the reader. If the reader is
self-driven (e.g. uses an {{XMLStreamReader}} as source), it does not need the
input, but the transformation will fail nevertheless.
I can supply a reproducer, based on [Commons Secure XML
PR#86](https://github.com/apache/commons-secure-xml/pull/86).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
