#606: make XmlUtil.newXMLInputFactory consistent with other methods

Signed-off-by: Lukas Jungmann <[email protected]>
eclipse-ee4j · Jun 9, 2022 · 24d31bb · 24d31bb
1 parent 170b4cb
commit 24d31bb
Show file tree

Hide file tree

Showing 8 changed files with 59 additions and 44 deletions.
diff --git a/...et/src/main/java/com/sun/xml/ws/transport/httpspi/servlet/DeploymentDescriptorParser.java b/...et/src/main/java/com/sun/xml/ws/transport/httpspi/servlet/DeploymentDescriptorParser.java
@@ -47,7 +47,7 @@ public class DeploymentDescriptorParser<A> {
     private final AdapterFactory<A> adapterFactory;
 
     // secure xml processing always enabled - parsing deployment descriptor ...
-    private static final XMLInputFactory xif = XmlUtil.newXMLInputFactory(true);
+    private static final XMLInputFactory xif = XmlUtil.newXMLInputFactory(false);
 
     /**
      * Endpoint names that are declared.

diff --git a/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/api/streaming/XMLStreamReaderFactory.java b/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/api/streaming/XMLStreamReaderFactory.java
@@ -104,7 +104,7 @@ private static XMLInputFactory getXMLInputFactory() {
             }
         }
         if (xif == null) {
-             xif = XmlUtil.newXMLInputFactory(true);
+             xif = XmlUtil.newXMLInputFactory(false);
         }
         xif.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true);
         xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);

diff --git a/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/assembler/MetroConfigLoader.java b/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/assembler/MetroConfigLoader.java
@@ -227,7 +227,7 @@ private static MetroConfig loadMetroConfig(@NotNull URL resourceUrl) {
         try (InputStream is = getConfigInputStream(resourceUrl)) {
             JAXBContext jaxbContext = createJAXBContext();
             Unmarshaller unmarshaller = jaxbContext.createUnmarshaller();
-            XMLInputFactory factory = XmlUtil.newXMLInputFactory(true);
+            XMLInputFactory factory = XmlUtil.newXMLInputFactory(false);
             JAXBElement<MetroConfig> configElement = unmarshaller.unmarshal(factory.createXMLStreamReader(is), MetroConfig.class);
             return configElement.getValue();
         } catch (Exception e) {

diff --git a/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/commons/xmlutil/Converter.java b/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/commons/xmlutil/Converter.java
@@ -163,7 +163,7 @@ public static byte[] toBytes(Message message, String encoding) throws XMLStreamE
      * @return {@link com.sun.xml.ws.api.message.Message} object created from the data stream
      */
     public static Message toMessage(@NotNull InputStream dataStream, String encoding) throws XMLStreamException {
-        XMLStreamReader xsr = XmlUtil.newXMLInputFactory(true).createXMLStreamReader(dataStream, encoding);
+        XMLStreamReader xsr = XmlUtil.newXMLInputFactory(false).createXMLStreamReader(dataStream, encoding);
         return Messages.create(xsr);
     }
 

diff --git a/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/policy/jaxws/PolicyWSDLParserExtension.java b/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/policy/jaxws/PolicyWSDLParserExtension.java
@@ -608,7 +608,7 @@ private boolean readExternalFile(final String fileUrl) {
         try {
             final URL xmlURL = new URL(fileUrl);
             ios = xmlURL.openStream();
-            reader = XmlUtil.newXMLInputFactory(true).createXMLStreamReader(ios);
+            reader = XmlUtil.newXMLInputFactory(false).createXMLStreamReader(ios);
             while (reader.hasNext()) {
                 if (reader.isStartElement() && NamespaceVersion.resolveAsToken(reader.getName()) == XmlToken.Policy) {
                     readSinglePolicy(policyReader.readPolicyElement(reader, fileUrl), false);

diff --git a/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/server/EndpointFactory.java b/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/server/EndpointFactory.java
@@ -366,7 +366,7 @@ public Iterator<SDDocumentImpl> iterator() {
                                     InputSource source = resolver.resolveEntity(null, url);
                                     if (source != null) {
                                         MutableXMLStreamBuffer xsb = new MutableXMLStreamBuffer();
-                                        XMLStreamReader reader = XmlUtil.newXMLInputFactory(true).createXMLStreamReader(source.getByteStream());
+                                        XMLStreamReader reader = XmlUtil.newXMLInputFactory(false).createXMLStreamReader(source.getByteStream());
                                         xsb.createFromXMLStreamReader(reader);
 
                                         SDDocumentSource sdocSource = SDDocumentImpl.create(new URL(url), xsb);

diff --git a/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/util/xml/XmlUtil.java b/jaxws-ri/runtime/rt/src/main/java/com/sun/xml/ws/util/xml/XmlUtil.java
@@ -64,11 +64,7 @@
  */
 public class XmlUtil {
 
-    // not in older JDK, so must be duplicated here, otherwise javax.xml.XMLConstants should be used
-    private static final String ACCESS_EXTERNAL_SCHEMA = "http://javax.xml.XMLConstants/property/accessExternalSchema";
-
-    private final static String LEXICAL_HANDLER_PROPERTY =
-	"http://xml.org/sax/properties/lexical-handler";
+    private final static String LEXICAL_HANDLER_PROPERTY = "http://xml.org/sax/properties/lexical-handler";
 
     private static final String DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";
     private static final String EXTERNAL_GE = "http://xml.org/sax/features/external-general-entities";
@@ -132,34 +128,6 @@ public static String getAttributeNSOrNull(
         return a.getValue();
     }
 
-/*    public static boolean matchesTagNS(Element e, String tag, String nsURI) {
-        try {
-            return e.getLocalName().equals(tag)
-                && e.getNamespaceURI().equals(nsURI);
-        } catch (NullPointerException npe) {
-
-            // localname not null since parsing would fail before here
-            throw new WSDLParseException(
-                "null.namespace.found",
-                e.getLocalName());
-        }
-    }
-
-    public static boolean matchesTagNS(
-        Element e,
-        javax.xml.namespace.QName name) {
-        try {
-            return e.getLocalName().equals(name.getLocalPart())
-                && e.getNamespaceURI().equals(name.getNamespaceURI());
-        } catch (NullPointerException npe) {
-
-            // localname not null since parsing would fail before here
-            throw new WSDLParseException(
-                "null.namespace.found",
-                e.getLocalName());
-        }
-    }*/
-
     public static Iterator getAllChildren(Element element) {
         return new NodeListIterator(element.getChildNodes());
     }
@@ -375,7 +343,7 @@ public static XPathFactory newXPathFactory(boolean disableSecurity) {
 
     public static XMLInputFactory newXMLInputFactory(boolean disableSecurity)  {
         XMLInputFactory factory = XMLInputFactory.newInstance();
-        if (xmlSecurityDisabled(disableSecurity)) {
+        if (!xmlSecurityDisabled(disableSecurity)) {
             // TODO-Miran: are those apppropriate defaults?
             factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
             factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
@@ -410,14 +378,14 @@ public static SchemaFactory allowExternalAccess(SchemaFactory sf, String value,
         }
 
         try {
-            sf.setProperty(ACCESS_EXTERNAL_SCHEMA, value);
+            sf.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, value);
             if (LOGGER.isLoggable(Level.FINE)) {
-                LOGGER.log(Level.FINE, "Property \"{0}\" is supported and has been successfully set by used JAXP implementation.", new Object[]{ACCESS_EXTERNAL_SCHEMA});
+                LOGGER.log(Level.FINE, "Property \"{0}\" is supported and has been successfully set by used JAXP implementation.", new Object[]{XMLConstants.ACCESS_EXTERNAL_SCHEMA});
             }
         } catch (SAXException ignored) {
             // nothing to do; support depends on version JDK or SAX implementation
             if (LOGGER.isLoggable(Level.CONFIG)) {
-                LOGGER.log(Level.CONFIG, "Property \"{0}\" is not supported by used JAXP implementation.", new Object[]{ACCESS_EXTERNAL_SCHEMA});
+                LOGGER.log(Level.CONFIG, "Property \"{0}\" is not supported by used JAXP implementation.", new Object[]{XMLConstants.ACCESS_EXTERNAL_SCHEMA});
             }
         }
         return sf;

diff --git a/jaxws-ri/runtime/rt/src/test/java/com/sun/xml/ws/util/xml/XmlUtilTest.java b/jaxws-ri/runtime/rt/src/test/java/com/sun/xml/ws/util/xml/XmlUtilTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2019 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Distribution License v. 1.0, which is available at
@@ -14,6 +14,18 @@
 import java.lang.reflect.Method;
 
 import junit.framework.TestCase;
+import org.junit.Assert;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.stream.XMLInputFactory;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.xpath.XPathFactory;
+import javax.xml.xpath.XPathFactoryConfigurationException;
 
 public class XmlUtilTest extends TestCase {
 
@@ -56,5 +68,40 @@ public void testXmlSecurityDisabled() throws InstantiationException, IllegalAcce
           fieldDisabledBySetting.set(com.sun.xml.ws.util.xml.XmlUtil.class, disabledBySetting);
        }
     }
+
+    public void testNewDocumentBuilderFactory() {
+        DocumentBuilderFactory factory = XmlUtil.newDocumentBuilderFactory(false);
+        Assert.assertFalse(factory.isExpandEntityReferences());
+        factory = XmlUtil.newDocumentBuilderFactory(true);
+        Assert.assertTrue(factory.isExpandEntityReferences());
+    }
+
+    public void testNewTransformerFactory() {
+        TransformerFactory factory = XmlUtil.newTransformerFactory(false);
+        Assert.assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING));
+        factory = XmlUtil.newTransformerFactory(true);
+        Assert.assertFalse(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING));
+    }
+
+    public void testNewSAXParserFactory() throws SAXNotSupportedException, SAXNotRecognizedException, ParserConfigurationException {
+        SAXParserFactory factory = XmlUtil.newSAXParserFactory(false);
+        Assert.assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING));
+        factory = XmlUtil.newSAXParserFactory(true);
+        Assert.assertFalse(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING));
+    }
+
+    public void testNewXPathFactory() throws XPathFactoryConfigurationException {
+        XPathFactory factory = XmlUtil.newXPathFactory(false);
+        Assert.assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING));
+        factory = XmlUtil.newXPathFactory(true);
+        Assert.assertFalse(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING));
+    }
+
+    public void testNewXMLInputFactory() {
+        XMLInputFactory factory = XmlUtil.newXMLInputFactory(false);
+        Assert.assertFalse((Boolean) factory.getProperty(XMLInputFactory.SUPPORT_DTD));
+        factory = XmlUtil.newXMLInputFactory(true);
+        Assert.assertTrue((Boolean) factory.getProperty(XMLInputFactory.SUPPORT_DTD));
+    }
 }