Take the 2-minute tour ×

Is there a way to protect Spring-WS app from XML bombs, if I am using JAXB2 un/marshaler...and Xalan 2.7.1 and Xerces, though I no longer know who depends on what anymore :) ....

Basically I want to disable DTD as schema language in entire app, and if that could be done from app context xml file, that would be great!

I guess the other option would be to extend/implement some class/interface, and change some method, but I don't know where in Spring-WS is parser first called....

share|improve this question
add comment

1 Answer

Java parsers generally have built-in protected for things like entity expansion attacks:


SAXParserFactory spf = SAXParserFactory.newInstance();
spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
XMLReader xmlReader = spf.newSAXParser().getXMLReader();
InputSource inputSource = new InputSource(new FileReader("input.xml"));
SAXSource source = new SAXSource(xmlReader, inputSource);

For More Information

share|improve this answer
add comment

Your Answer


