Package gw.xml.simple

Class SimpleXmlParser

java.lang.Object

gw.xml.simple.SimpleXmlParser

public class SimpleXmlParser
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
private static ThreadLocal<SAXParser>	_saxParser

Constructor Summary

Constructors

Modifier	Constructor	Description
private	SimpleXmlParser()

Method Summary

Modifier and Type	Method	Description
private static void	disableExternalEntities(SAXParserFactory factory)	The purpose of this method is to prevent vulnerabilities related to XXE (XML external entity injection).
private static SAXParser	makeSAXParser()
private static RuntimeException	maybeWrapException(Exception e)
static SimpleXmlNode	parseFile(File file)
static SimpleXmlNode	parseInputStream(InputStream stream)
static SimpleXmlNode	parseString(String s)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

_saxParser

private static ThreadLocal<SAXParser> _saxParser

Constructor Details

SimpleXmlParser

private SimpleXmlParser()

Method Details

parseFile

public static SimpleXmlNode parseFile(File file)

parseInputStream

public static SimpleXmlNode parseInputStream(InputStream stream)

parseString

public static SimpleXmlNode parseString(String s)

maybeWrapException

private static RuntimeException maybeWrapException(Exception e)

makeSAXParser

private static SAXParser makeSAXParser()
                                throws ParserConfigurationException,
SAXException

Throws:

ParserConfigurationException

SAXException

disableExternalEntities

private static void disableExternalEntities(SAXParserFactory factory)
                                     throws ParserConfigurationException,
SAXNotRecognizedException,
SAXNotSupportedException

The purpose of this method is to prevent vulnerabilities related to XXE (XML external entity injection). Although the nature of XML parsing in this case is such that it is _not_ vulnerable, we configure the parser in this way to appease those who demand zero alarm results from static analysis tooling such as Veracode.

Throws:

ParserConfigurationException

SAXNotRecognizedException

SAXNotSupportedException