garydgregory commented on code in PR #288:
URL: https://github.com/apache/commons-jxpath/pull/288#discussion_r3943963438
##########
src/main/java/org/apache/commons/jxpath/xml/JDOMParser.java:
##########
@@ -40,7 +45,19 @@ public Object parseXML(final InputStream stream) {
throw new JXPathException("JDOM parser configuration error. JDOM
does not support the namespaceAware=false setting.");
}
try {
- final SAXBuilder builder = new SAXBuilder();
+ // JDOM builds its reader through JAXP internally; hand it one
from the secure factory instead.
+ final SAXBuilder builder = new SAXBuilder() {
+ @Override
+ protected XMLReader createParser() throws JDOMException {
+ try {
+ final SAXParserFactory factory =
SecureSAXParserFactory.newNSInstance();
+ factory.setValidating(isValidating());
+ return factory.newSAXParser().getXMLReader();
+ } catch (final Exception ex) {
+ throw new JDOMException("Unable to create a new XML
reader", ex);
+ }
+ }
+ };
Review Comment:
@ppkarwasz Why aren't the other builder setters in the try block?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
