1.1 --- a/src/share/jaxws_classes/com/sun/xml/internal/bind/v2/util/XmlFactory.java Thu Sep 26 10:43:28 2013 -0700
1.2 +++ b/src/share/jaxws_classes/com/sun/xml/internal/bind/v2/util/XmlFactory.java Fri Oct 04 16:21:34 2013 +0100
1.3 @@ -43,6 +43,8 @@
1.4 import org.xml.sax.SAXNotRecognizedException;
1.5 import org.xml.sax.SAXNotSupportedException;
1.6
1.7 +import static com.sun.xml.internal.bind.Util.getSystemProperty;
1.8 +
1.9 /**
1.10 * Provides helper methods for creating properly configured XML parser
1.11 * factory instances with namespace support turned on and configured for
1.12 @@ -53,6 +55,7 @@
1.13
1.14 // not in older JDK, so must be duplicated here, otherwise javax.xml.XMLConstants should be used
1.15 public static final String ACCESS_EXTERNAL_SCHEMA = "http://javax.xml.XMLConstants/property/accessExternalSchema";
1.16 + public static final String ACCESS_EXTERNAL_DTD = "http://javax.xml.XMLConstants/property/accessExternalDTD";
1.17
1.18 private static final Logger LOGGER = Logger.getLogger(XmlFactory.class.getName());
1.19
1.20 @@ -65,11 +68,10 @@
1.21 */
1.22 private static final String DISABLE_XML_SECURITY = "com.sun.xml.internal.bind.disableXmlSecurity";
1.23
1.24 - public static final boolean DISABLE_SECURE_PROCESSING =
1.25 - Boolean.parseBoolean(Util.getSystemProperty(DISABLE_XML_SECURITY));
1.26 + public static final boolean XML_SECURITY_DISABLED = Boolean.parseBoolean(getSystemProperty(DISABLE_XML_SECURITY));
1.27
1.28 - private static boolean xmlFeatureValue(boolean runtimeSetting) {
1.29 - return !(DISABLE_SECURE_PROCESSING || runtimeSetting);
1.30 + private static boolean isXMLSecurityDisabled(boolean runtimeSetting) {
1.31 + return XML_SECURITY_DISABLED || runtimeSetting;
1.32 }
1.33
1.34 /**
1.35 @@ -83,7 +85,7 @@
1.36 if (LOGGER.isLoggable(Level.FINE)) {
1.37 LOGGER.log(Level.FINE, "SchemaFactory instance: {0}", factory);
1.38 }
1.39 - factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, xmlFeatureValue(disableSecureProcessing));
1.40 + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, !isXMLSecurityDisabled(disableSecureProcessing));
1.41 return factory;
1.42 } catch (SAXNotRecognizedException ex) {
1.43 LOGGER.log(Level.SEVERE, null, ex);
1.44 @@ -109,7 +111,7 @@
1.45 LOGGER.log(Level.FINE, "SAXParserFactory instance: {0}", factory);
1.46 }
1.47 factory.setNamespaceAware(true);
1.48 - factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, xmlFeatureValue(disableSecureProcessing));
1.49 + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, !isXMLSecurityDisabled(disableSecureProcessing));
1.50 return factory;
1.51 } catch (ParserConfigurationException ex) {
1.52 LOGGER.log(Level.SEVERE, null, ex);
1.53 @@ -136,7 +138,7 @@
1.54 if (LOGGER.isLoggable(Level.FINE)) {
1.55 LOGGER.log(Level.FINE, "XPathFactory instance: {0}", factory);
1.56 }
1.57 - factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, xmlFeatureValue(disableSecureProcessing));
1.58 + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, !isXMLSecurityDisabled(disableSecureProcessing));
1.59 return factory;
1.60 } catch (XPathFactoryConfigurationException ex) {
1.61 LOGGER.log(Level.SEVERE, null, ex);
1.62 @@ -157,7 +159,7 @@
1.63 if (LOGGER.isLoggable(Level.FINE)) {
1.64 LOGGER.log(Level.FINE, "TransformerFactory instance: {0}", factory);
1.65 }
1.66 - factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, xmlFeatureValue(disableSecureProcessing));
1.67 + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, !isXMLSecurityDisabled(disableSecureProcessing));
1.68 return factory;
1.69 } catch (TransformerConfigurationException ex) {
1.70 LOGGER.log(Level.SEVERE, null, ex);
1.71 @@ -180,7 +182,7 @@
1.72 LOGGER.log(Level.FINE, "DocumentBuilderFactory instance: {0}", factory);
1.73 }
1.74 factory.setNamespaceAware(true);
1.75 - factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, xmlFeatureValue(disableSecureProcessing));
1.76 + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, !isXMLSecurityDisabled(disableSecureProcessing));
1.77 return factory;
1.78 } catch (ParserConfigurationException ex) {
1.79 LOGGER.log(Level.SEVERE, null, ex);
1.80 @@ -191,20 +193,64 @@
1.81 }
1.82 }
1.83
1.84 - public static SchemaFactory allowFileAccess(SchemaFactory sf, boolean disableSecureProcessing) {
1.85 + public static SchemaFactory allowExternalAccess(SchemaFactory sf, String value, boolean disableSecureProcessing) {
1.86
1.87 - // if feature secure processing enabled, nothing to do, file is allowed,
1.88 - // or user is able to control access by standard JAXP mechanisms
1.89 - if (disableSecureProcessing) {
1.90 + // if xml security (feature secure processing) disabled, nothing to do, no restrictions applied
1.91 + if (isXMLSecurityDisabled(disableSecureProcessing)) {
1.92 + if (LOGGER.isLoggable(Level.FINE)) {
1.93 + LOGGER.log(Level.FINE, Messages.JAXP_XML_SECURITY_DISABLED.format());
1.94 + }
1.95 + return sf;
1.96 + }
1.97 +
1.98 + if (System.getProperty("javax.xml.accessExternalSchema") != null) {
1.99 + if (LOGGER.isLoggable(Level.FINE)) {
1.100 + LOGGER.log(Level.FINE, Messages.JAXP_EXTERNAL_ACCESS_CONFIGURED.format());
1.101 + }
1.102 return sf;
1.103 }
1.104
1.105 try {
1.106 - sf.setProperty(ACCESS_EXTERNAL_SCHEMA, "file");
1.107 - LOGGER.log(Level.FINE, Messages.JAXP_SUPPORTED_PROPERTY.format(ACCESS_EXTERNAL_SCHEMA));
1.108 + sf.setProperty(ACCESS_EXTERNAL_SCHEMA, value);
1.109 + if (LOGGER.isLoggable(Level.FINE)) {
1.110 + LOGGER.log(Level.FINE, Messages.JAXP_SUPPORTED_PROPERTY.format(ACCESS_EXTERNAL_SCHEMA));
1.111 + }
1.112 } catch (SAXException ignored) {
1.113 // nothing to do; support depends on version JDK or SAX implementation
1.114 - LOGGER.log(Level.CONFIG, Messages.JAXP_UNSUPPORTED_PROPERTY.format(ACCESS_EXTERNAL_SCHEMA), ignored);
1.115 + if (LOGGER.isLoggable(Level.CONFIG)) {
1.116 + LOGGER.log(Level.CONFIG, Messages.JAXP_UNSUPPORTED_PROPERTY.format(ACCESS_EXTERNAL_SCHEMA), ignored);
1.117 + }
1.118 + }
1.119 + return sf;
1.120 + }
1.121 +
1.122 + public static SchemaFactory allowExternalDTDAccess(SchemaFactory sf, String value, boolean disableSecureProcessing) {
1.123 +
1.124 + // if xml security (feature secure processing) disabled, nothing to do, no restrictions applied
1.125 + if (isXMLSecurityDisabled(disableSecureProcessing)) {
1.126 + if (LOGGER.isLoggable(Level.FINE)) {
1.127 + LOGGER.log(Level.FINE, Messages.JAXP_XML_SECURITY_DISABLED.format());
1.128 + }
1.129 + return sf;
1.130 + }
1.131 +
1.132 + if (System.getProperty("javax.xml.accessExternalDTD") != null) {
1.133 + if (LOGGER.isLoggable(Level.FINE)) {
1.134 + LOGGER.log(Level.FINE, Messages.JAXP_EXTERNAL_ACCESS_CONFIGURED.format());
1.135 + }
1.136 + return sf;
1.137 + }
1.138 +
1.139 + try {
1.140 + sf.setProperty(ACCESS_EXTERNAL_DTD, value);
1.141 + if (LOGGER.isLoggable(Level.FINE)) {
1.142 + LOGGER.log(Level.FINE, Messages.JAXP_SUPPORTED_PROPERTY.format(ACCESS_EXTERNAL_DTD));
1.143 + }
1.144 + } catch (SAXException ignored) {
1.145 + // nothing to do; support depends on version JDK or SAX implementation
1.146 + if (LOGGER.isLoggable(Level.CONFIG)) {
1.147 + LOGGER.log(Level.CONFIG, Messages.JAXP_UNSUPPORTED_PROPERTY.format(ACCESS_EXTERNAL_DTD), ignored);
1.148 + }
1.149 }
1.150 return sf;
1.151 }
