You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It looks like the doSupportDTDs and resolver could have been inherited from the factory here.
Example code to reproduce:
WstxInputFactory inputFactory = new WstxInputFactory();
inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, true);
inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, true);
inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, true);
inputFactory.setXMLResolver(new XMLResolver() {
@Override
public Object resolveEntity(String publicID, String systemID, String baseURI, String namespace)
throws XMLStreamException {
return "";
}
});
WstxSAXParserFactory factory = new WstxSAXParserFactory(xmlInputFactory);
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
...
//expectation: this parser is configured as per above configuration and quietly ignores external entities, it does not work unless the resolver is set again on the parser itself explicitly
factory .newSAXParser();
The handling of the features flags in WstxSAXParser is also a bit suspicious as most seem to have a fixed value rather than reflecting the factory features.
The text was updated successfully, but these errors were encountered:
Thank you for reporting the issue -- you are probably right in that settings are not being propagated. One challenge may be that Stax and SAX configuration are not exactly 1-to-1 mappable, but then again underlying Woodstox configuration should be valid.
The WstxSAXParser constructor seems to mostly ignore configuration from the provided factory and uses some fixed values:
woodstox/src/main/java/com/ctc/wstx/sax/WstxSAXParser.java
Line 222 in 012a512
It looks like the doSupportDTDs and resolver could have been inherited from the factory here.
Example code to reproduce:
The handling of the features flags in WstxSAXParser is also a bit suspicious as most seem to have a fixed value rather than reflecting the factory features.
The text was updated successfully, but these errors were encountered: