1.1 --- a/src/share/jaxws_classes/com/sun/xml/internal/xsom/parser/JAXPParser.java Thu Aug 08 10:10:38 2013 -0700 1.2 +++ b/src/share/jaxws_classes/com/sun/xml/internal/xsom/parser/JAXPParser.java Fri Aug 23 09:57:21 2013 +0100 1.3 @@ -1,5 +1,5 @@ 1.4 /* 1.5 - * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved. 1.6 + * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved. 1.7 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 1.8 * 1.9 * This code is free software; you can redistribute it and/or modify it 1.10 @@ -27,18 +27,14 @@ 1.11 1.12 import java.io.IOException; 1.13 import java.net.URL; 1.14 +import java.util.logging.Level; 1.15 +import java.util.logging.Logger; 1.16 1.17 import javax.xml.parsers.ParserConfigurationException; 1.18 +import javax.xml.parsers.SAXParser; 1.19 import javax.xml.parsers.SAXParserFactory; 1.20 1.21 -import org.xml.sax.ContentHandler; 1.22 -import org.xml.sax.EntityResolver; 1.23 -import org.xml.sax.ErrorHandler; 1.24 -import org.xml.sax.InputSource; 1.25 -import org.xml.sax.Locator; 1.26 -import org.xml.sax.SAXException; 1.27 -import org.xml.sax.SAXParseException; 1.28 -import org.xml.sax.XMLReader; 1.29 +import org.xml.sax.*; 1.30 import org.xml.sax.helpers.XMLFilterImpl; 1.31 1.32 import com.sun.xml.internal.xsom.impl.parser.Messages; 1.33 @@ -51,6 +47,11 @@ 1.34 */ 1.35 public class JAXPParser implements XMLParser { 1.36 1.37 + // not in older JDK, so must be duplicated here, otherwise javax.xml.XMLConstants should be used 1.38 + private static final String ACCESS_EXTERNAL_SCHEMA = "http://javax.xml.XMLConstants/property/accessExternalSchema"; 1.39 + 1.40 + private static final Logger LOGGER = Logger.getLogger(JAXPParser.class.getName()); 1.41 + 1.42 private final SAXParserFactory factory; 1.43 1.44 public JAXPParser( SAXParserFactory factory ) { 1.45 @@ -58,6 +59,11 @@ 1.46 this.factory = factory; 1.47 } 1.48 1.49 + /** 1.50 + * @deprecated Unsafe, use JAXPParser(factory) instead with 1.51 + * security features initialized by setting 1.52 + * XMLConstants.FEATURE_SECURE_PROCESSING feature. 1.53 + */ 1.54 public JAXPParser() { 1.55 this( SAXParserFactory.newInstance()); 1.56 } 1.57 @@ -68,8 +74,8 @@ 1.58 throws SAXException, IOException { 1.59 1.60 try { 1.61 - XMLReader reader = factory.newSAXParser().getXMLReader(); 1.62 - reader = new XMLReaderEx(reader); 1.63 + SAXParser saxParser = allowFileAccess(factory.newSAXParser(), false); 1.64 + XMLReader reader = new XMLReaderEx(saxParser.getXMLReader()); 1.65 1.66 reader.setContentHandler(handler); 1.67 if(errorHandler!=null) 1.68 @@ -85,6 +91,24 @@ 1.69 } 1.70 } 1.71 1.72 + private static SAXParser allowFileAccess(SAXParser saxParser, boolean disableSecureProcessing) throws SAXException { 1.73 + 1.74 + // if feature secure processing enabled, nothing to do, file is allowed, 1.75 + // or user is able to control access by standard JAXP mechanisms 1.76 + if (disableSecureProcessing) { 1.77 + return saxParser; 1.78 + } 1.79 + 1.80 + try { 1.81 + saxParser.setProperty(ACCESS_EXTERNAL_SCHEMA, "file"); 1.82 + LOGGER.log(Level.FINE, Messages.format(Messages.JAXP_SUPPORTED_PROPERTY, ACCESS_EXTERNAL_SCHEMA)); 1.83 + } catch (SAXException ignored) { 1.84 + // nothing to do; support depends on version JDK or SAX implementation 1.85 + LOGGER.log(Level.CONFIG, Messages.format(Messages.JAXP_UNSUPPORTED_PROPERTY, ACCESS_EXTERNAL_SCHEMA), ignored); 1.86 + } 1.87 + return saxParser; 1.88 + } 1.89 + 1.90 /** 1.91 * XMLReader with improved error message for entity resolution failure. 1.92 *