org.alfresco.xmlfactory

Class FactoryHelper

java.lang.Object

org.alfresco.xmlfactory.FactoryHelper

public class FactoryHelper
extends Object

The configuration is taken from https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#Java

Field Summary

Fields

Modifier and Type	Field and Description
static List<String>	DEFAULT_FEATURES_TO_DISABLE
static List<String>	DEFAULT_FEATURES_TO_ENABLE
static List<String>	DEFAULT_WHITE_LIST_CALLERS
static String	FEATURE_DISALLOW_DOCTYPE
static String	FEATURE_EXTERNAL_GENERAL_ENTITIES
static String	FEATURE_EXTERNAL_PARAMETER_ENTITIES
static String	FEATURE_LOAD_EXTERNAL_DTD
static String	FEATURE_USE_ENTITY_RESOLVER2
static String	FEATURES_TO_DISABLE
static String	FEATURES_TO_ENABLE
static String	WHITE_LIST_CALLERS

Constructor Summary

Constructors

Constructor and Description
FactoryHelper()

Method Summary

Modifier and Type	Method and Description
void	configureFactory(DocumentBuilderFactory factory, List<String> featuresToEnable, List<String> featuresToDisable, List<String> whiteListCallers)
void	configureFactory(SAXParserFactory factory, List<String> featuresToEnable, List<String> featuresToDisable, List<String> whiteListCallers)
List<String>	getConfiguration(Class<?> factoryClass, String propertyName, List<String> defaultFeatures) Returns a List of features (to be enabled or disabled) or class names (to be included in a caller white list) for a factory.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

FEATURE_EXTERNAL_GENERAL_ENTITIES

public static final String FEATURE_EXTERNAL_GENERAL_ENTITIES

See Also:

Constant Field Values

FEATURE_EXTERNAL_PARAMETER_ENTITIES

public static final String FEATURE_EXTERNAL_PARAMETER_ENTITIES

See Also:

Constant Field Values

FEATURE_USE_ENTITY_RESOLVER2

public static final String FEATURE_USE_ENTITY_RESOLVER2

See Also:

Constant Field Values

FEATURE_LOAD_EXTERNAL_DTD

public static final String FEATURE_LOAD_EXTERNAL_DTD

See Also:

Constant Field Values

FEATURE_DISALLOW_DOCTYPE

public static final String FEATURE_DISALLOW_DOCTYPE

See Also:

Constant Field Values

DEFAULT_FEATURES_TO_DISABLE

public static final List<String> DEFAULT_FEATURES_TO_DISABLE

DEFAULT_FEATURES_TO_ENABLE

public static final List<String> DEFAULT_FEATURES_TO_ENABLE

DEFAULT_WHITE_LIST_CALLERS

public static final List<String> DEFAULT_WHITE_LIST_CALLERS

FEATURES_TO_ENABLE

public static final String FEATURES_TO_ENABLE

See Also:

Constant Field Values

FEATURES_TO_DISABLE

public static final String FEATURES_TO_DISABLE

See Also:

Constant Field Values

WHITE_LIST_CALLERS

public static final String WHITE_LIST_CALLERS

See Also:

Constant Field Values

Constructor Detail

FactoryHelper

public FactoryHelper()

Method Detail

configureFactory

public void configureFactory(DocumentBuilderFactory factory,
                             List<String> featuresToEnable,
                             List<String> featuresToDisable,
                             List<String> whiteListCallers)

configureFactory

public void configureFactory(SAXParserFactory factory,
                             List<String> featuresToEnable,
                             List<String> featuresToDisable,
                             List<String> whiteListCallers)

getConfiguration

public List<String> getConfiguration(Class<?> factoryClass,
                                     String propertyName,
                                     List<String> defaultFeatures)

Returns a List of features (to be enabled or disabled) or class names (to be included in a caller white list) for a factory. A similar approach to the one used to select the JAXP factories in the first place is used to find a property value for each configurable value. The property names are: features.to.enable, features.to.disable and white.list.callers. The following order is used to find a semicolon separated list of values for each property:

A system property <factoryName>. if it exists and is accessible. A property in $JAVA_HOME/lib/<factoryName>.properties if it exists. A property in META-INF/services/<factoryName>.properties if it exists. The deafultFeatures parameter passed to this method.

Parameters:

factoryClass - used to look up the <factoryName>.

propertyName - used as the property name in files or as the suffix in a sysme property.

defaultFeatures - to be returned if other values are not found.

Returns:

the list of features or class names.