Package org.wildfly.common.xml

Class DocumentBuilderFactoryUtil

java.lang.Object

org.wildfly.common.xml.DocumentBuilderFactoryUtil

public final class DocumentBuilderFactoryUtil
extends Object

Factory provides DocumentBuilderFactory with secure defaults set. Properties not supported generate a warning, but the factory process creation will continue and return a result. Settings based on recommendations of Sonarcloud RSPEC-2755 and OWASP XML External Entity Prevention Cheatsheet.

• XMLConstants.FEATURE_SECURE_PROCESSING is set to true.
• XMLConstants.ACCESS_EXTERNAL_DTD is set to empty.
• XMLConstants.ACCESS_EXTERNAL_SCHEMA is set to empty.
• FactoryConstants.APACHE_DISALLOW_DOCTYPE_DECL is set to true.
• FactoryConstants.APACHE_LOAD_EXTERNAL_DTD is set to false.
• FactoryConstants.XML_EXTERNAL_GENERAL_ENTITIES is set to false.
• FactoryConstants.XML_EXTERNAL_PARAMETER_ENTITIES is set to false.
• DocumentBuilderFactory.setXIncludeAware(boolean) is set to false.
• DocumentBuilderFactory.setExpandEntityReferences(boolean) is set to false.

Since:

1.6.0.Final

Author:

Boris Unckel

Method Summary

Modifier and Type	Method	Description
static DocumentBuilderFactory	create()	Factory generated with secure defaults.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

create

@NotNull
public static DocumentBuilderFactory create()

Factory generated with secure defaults.

Returns:

an instance of the DocumentBuilderFactory.