java - How to disable XML External Entity(XEE) processing in SAXBuilder which using com.sun.org.apache.xerces.internal.parsers.SAXParser -
here snippet:
public static saxbuilder createbuilder(@notnull final string schemapath) { final saxbuilder builder = new saxbuilder("com.sun.org.apache.xerces.internal.parsers.saxparser", true); builder.setfeature("http://apache.org/xml/features/validation/schema", true); builder.setfeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); builder.setfeature("http://apache.org/xml/features/disallow-doctype-decl",true); builder.setfeature("http://xml.org/sax/features/external-general-entities", false); builder.setfeature("http://xml.org/sax/features/external-parameter-entities", false); builder.setexpandentities(false); builder.setproperty("http://apache.org/xml/properties/schema/external-nonamespaceschemalocation", schemapath); builder.setentityresolver(getentityresolver()); return builder; } i have spent time searching, there's not left out there
Comments
Post a Comment