Package org.kuali.coeus.s2sgen.impl.util

Class SafeXmlUtils

java.lang.Object

org.kuali.coeus.s2sgen.impl.util.SafeXmlUtils

public class SafeXmlUtils
extends Object

Utility class to help avoid security vulnerabilities with various XML libraries.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	DISALLOW_DOCTYPE_DECL
static final String	EXTERNAL_GENERAL_ENTITIES
static final String	EXTERNAL_PARAMETER_ENTITIES
static final String	LOAD_EXTERNAL_DTD

Method Summary

Modifier and Type	Method	Description
static DocumentBuilderFactory	safeDocumentBuilderFactory()	Creates a DocumentBuilderFactory that configures certain features to avoid XXE attacks as documented: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
static SAXParserFactory	safeSAXParserFactory()
static SchemaFactory	safeSchemaFactory()
static TransformerFactory	safeTransformerFactory()	Creates a TransformerFactory that configures certain attributes to avoid XXE attacks as documented: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
static Validator	safeValidator(Schema schema)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DISALLOW_DOCTYPE_DECL

public static final String DISALLOW_DOCTYPE_DECL

See Also:

• Constant Field Values

EXTERNAL_GENERAL_ENTITIES

public static final String EXTERNAL_GENERAL_ENTITIES

See Also:

• Constant Field Values

EXTERNAL_PARAMETER_ENTITIES

public static final String EXTERNAL_PARAMETER_ENTITIES

See Also:

• Constant Field Values

LOAD_EXTERNAL_DTD

public static final String LOAD_EXTERNAL_DTD

See Also:

• Constant Field Values

Method Details

safeDocumentBuilderFactory

public static DocumentBuilderFactory safeDocumentBuilderFactory()

Creates a DocumentBuilderFactory that configures certain features to avoid XXE attacks as documented: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

safeTransformerFactory

public static TransformerFactory safeTransformerFactory()

Creates a TransformerFactory that configures certain attributes to avoid XXE attacks as documented: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

safeSAXParserFactory

public static SAXParserFactory safeSAXParserFactory()
                                             throws SAXNotSupportedException,
SAXNotRecognizedException,
ParserConfigurationException

Throws:

SAXNotSupportedException

SAXNotRecognizedException

ParserConfigurationException

safeValidator

public static Validator safeValidator(Schema schema)
                               throws SAXNotRecognizedException,
SAXNotSupportedException

Throws:

SAXNotRecognizedException

SAXNotSupportedException

safeSchemaFactory

public static SchemaFactory safeSchemaFactory()
                                       throws SAXNotRecognizedException,
SAXNotSupportedException

Throws:

SAXNotRecognizedException

SAXNotSupportedException