dependency-check-utils/src/main/java/org/owasp/dependencycheck/utils/XmlUtils.java
/**
     * Constructs a validating secure SAX Parser.
     *
     * @param schemaStream the schema to validate the XML against
     * @return a SAX Parser
     * @throws ParserConfigurationException is thrown if there is a parser
     * configuration exception
     * @throws SAXNotRecognizedException thrown if there is an unrecognized
     * feature
     * @throws SAXNotSupportedException thrown if there is a non-supported
     * feature
     * @throws SAXException is thrown if there is a SAXException
     */
Constructs a validating secure SAX Parser.
Constructs a validating secure SAX Parser .
public static SAXParser buildSecureSaxParser(InputStream schemaStream) throws ParserConfigurationException,
            SAXNotRecognizedException, SAXNotSupportedException, SAXException {
        final SAXParserFactory factory = SAXParserFactory.newInstance();
        factory.setNamespaceAware(true);
        factory.setValidating(true);
        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
        final SAXParser saxParser = factory.newSAXParser();
        saxParser.setProperty(JAXP_SCHEMA_LANGUAGE, W3C_XML_SCHEMA);
        saxParser.setProperty(JAXP_SCHEMA_SOURCE, schemaStream);
        return saxParser;
    }
public static SAXParser buildSecureSaxParser ( InputStream schemaStream ) throws ParserConfigurationException , SAXNotRecognizedException , SAXNotSupportedException , SAXException { final SAXParserFactory factory = SAXParserFactory . newInstance ( ) ; factory . setNamespaceAware ( true ) ; factory . setValidating ( true ) ; factory . setFeature ( "http://apache.org/xml/features/disallow-doctype-decl" , true ) ; factory . setFeature ( "http://xml.org/sax/features/external-general-entities" , false ) ; final SAXParser saxParser = factory . newSAXParser ( ) ; saxParser . setProperty ( JAXP_SCHEMA_LANGUAGE , W3C_XML_SCHEMA ) ; saxParser . setProperty ( JAXP_SCHEMA_SOURCE , schemaStream ) ; return saxParser ; }
Constructs a validating secure SAX Parser.
Constructs a validating secure SAX Parser .
//setting the following unfortunately breaks reading the old suppression files (version 1). //factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);