com.prosysopc.ua.stack.utils

Class XMLFactoryCache

java.lang.Object

com.prosysopc.ua.stack.utils.XMLFactoryCache

public class XMLFactoryCache
extends Object

A cache for XXXFactory instances which are needed in XML processing. Idea is that this is the common place to find a factory so it needs to be created only once (which is a time-consuming operation).

Constructor Summary

Constructors

Constructor and Description
XMLFactoryCache()

Method Summary

Modifier and Type	Method and Description
static DocumentBuilderFactory	getDocumentBuilderFactory() getDocumentBuilderFactory.
static SAXTransformerFactory	getSAXTransformerFactory() getSAXTransformerFactory.
static TransformerFactory	getTransformerFactory() getTransformerFactory.
static XMLInputFactory	getXMLInputFactory() getXMLInputFactory.
static void	setIgnoreErrorsOnDefaultInitialization(boolean ignoreErrorsOnDefaultInitialization) Set this to true to suppress error logs if DTD processing cannot be disabled (CVE-2018-12585).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

XMLFactoryCache

public XMLFactoryCache()

Method Detail

getDocumentBuilderFactory

public static DocumentBuilderFactory getDocumentBuilderFactory()

getDocumentBuilderFactory.

Returns:

a DocumentBuilderFactory object.

getSAXTransformerFactory

public static SAXTransformerFactory getSAXTransformerFactory()

getSAXTransformerFactory.

Returns:

a SAXTransformerFactory object.

getTransformerFactory

public static TransformerFactory getTransformerFactory()

getTransformerFactory.

Returns:

a TransformerFactory object.

getXMLInputFactory

public static XMLInputFactory getXMLInputFactory()

getXMLInputFactory.

Returns:

a XMLInputFactory object.

setIgnoreErrorsOnDefaultInitialization

public static void setIgnoreErrorsOnDefaultInitialization(boolean ignoreErrorsOnDefaultInitialization)

Set this to true to suppress error logs if DTD processing cannot be disabled (CVE-2018-12585). This should be only used if custom XML parser framework is in use and the equivalent of default initialization has been done to the static factories available.

See Also:

https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#Java