@@ -54,30 +54,28 @@ public static XMLFactorySAX newInstanceSecure(boolean validating) throws XMLExce
54
54
return newInstanceSecure (validating , false );
55
55
}
56
56
57
- public static SAXParserFactory disableExternalEntity (SAXParserFactory saxFac ) throws XMLException {
58
- return XMLException .get ( () -> {
59
- saxFac .setFeature ("http://apache.org/xml/features/disallow-doctype-decl" , true );
60
- saxFac .setFeature ("http://xml.org/sax/features/external-general-entities" , false );
61
- saxFac .setFeature ("http://xml.org/sax/features/external-parameter-entities" , false );
62
- saxFac .setFeature ("http://apache.org/xml/features/nonvalidating/load-external-dtd" , false );
63
- saxFac .setXIncludeAware (false );
64
- return saxFac ;
65
- } );
66
- }
67
-
68
- private static SAXParserFactory init ( boolean validating , boolean namespaceAware ) {
69
- SAXParserFactory saxFac = SAXParserFactory .newInstance ();
70
- saxFac .setValidating (validating );
71
- saxFac .setNamespaceAware (namespaceAware );
72
- return saxFac ;
57
+ public static XMLFactorySAX newInstanceSecure (boolean validating , boolean namespaceAware ) throws XMLException {
58
+ return newInstance ( validating , namespaceAware , Boolean .TRUE );
73
59
}
74
60
75
- public static XMLFactorySAX newInstanceSecure (boolean validating , boolean namespaceAware ) throws XMLException {
76
- return new XMLFactorySAX ( disableExternalEntity ( init ( validating , namespaceAware ) ) );
61
+ public static XMLFactorySAX newInstance (boolean validating , boolean namespaceAware ) throws XMLException {
62
+ return newInstance ( validating , namespaceAware , Boolean . FALSE );
77
63
}
78
64
79
- public static XMLFactorySAX newInstance (boolean validating , boolean namespaceAware ) {
80
- return new XMLFactorySAX ( init ( validating , namespaceAware ) );
65
+ public static XMLFactorySAX newInstance (boolean validating , boolean namespaceAware , boolean secure ) throws XMLException {
66
+ return XMLException .get ( () -> {
67
+ SAXParserFactory factory = SAXParserFactory .newInstance ();
68
+ factory .setValidating (validating );
69
+ factory .setNamespaceAware (namespaceAware );
70
+ if ( secure ) {
71
+ factory .setFeature ("http://apache.org/xml/features/disallow-doctype-decl" , true );
72
+ factory .setFeature ("http://xml.org/sax/features/external-general-entities" , false );
73
+ factory .setFeature ("http://xml.org/sax/features/external-parameter-entities" , false );
74
+ factory .setFeature ("http://apache.org/xml/features/nonvalidating/load-external-dtd" , false );
75
+ factory .setXIncludeAware (false );
76
+ }
77
+ return new XMLFactorySAX ( factory );
78
+ } );
81
79
}
82
80
83
81
public void setValidating (boolean val ) {
0 commit comments