Package gw.xml.simple

Class SimpleXmlParser

java.lang.Object

gw.xml.simple.SimpleXmlParser

public class SimpleXmlParser
extends java.lang.Object

Field Summary

Fields

Modifier and Type	Field	Description
private static java.lang.ThreadLocal<javax.xml.parsers.SAXParser>	_saxParser

Constructor Summary

Constructors

Modifier	Constructor	Description
private	SimpleXmlParser()

Method Summary

Modifier and Type	Method	Description
private static void	disableExternalEntities(javax.xml.parsers.SAXParserFactory factory)	The purpose of this method is to prevent vulnerabilities related to XXE (XML external entity injection).
private static javax.xml.parsers.SAXParser	makeSAXParser()
private static java.lang.RuntimeException	maybeWrapException(java.lang.Exception e)
static SimpleXmlNode	parseFile(java.io.File file)
static SimpleXmlNode	parseInputStream(java.io.InputStream stream)
static SimpleXmlNode	parseString(java.lang.String s)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

_saxParser

private static java.lang.ThreadLocal<javax.xml.parsers.SAXParser> _saxParser

Constructor Detail

SimpleXmlParser

private SimpleXmlParser()

Method Detail

parseFile

public static SimpleXmlNode parseFile(java.io.File file)

parseInputStream

public static SimpleXmlNode parseInputStream(java.io.InputStream stream)

parseString

public static SimpleXmlNode parseString(java.lang.String s)

maybeWrapException

private static java.lang.RuntimeException maybeWrapException(java.lang.Exception e)

makeSAXParser

private static javax.xml.parsers.SAXParser makeSAXParser()
                                                  throws javax.xml.parsers.ParserConfigurationException,
                                                         org.xml.sax.SAXException

Throws:

javax.xml.parsers.ParserConfigurationException

org.xml.sax.SAXException

disableExternalEntities

private static void disableExternalEntities(javax.xml.parsers.SAXParserFactory factory)
                                     throws javax.xml.parsers.ParserConfigurationException,
                                            org.xml.sax.SAXNotRecognizedException,
                                            org.xml.sax.SAXNotSupportedException

The purpose of this method is to prevent vulnerabilities related to XXE (XML external entity injection). Although the nature of XML parsing in this case is such that it is _not_ vulnerable, we configure the parser in this way to appease those who demand zero alarm results from static analysis tooling such as Veracode.

Throws:

javax.xml.parsers.ParserConfigurationException

org.xml.sax.SAXNotRecognizedException

org.xml.sax.SAXNotSupportedException