Author: remy.maucherat(a)jboss.com Date: 2007-10-19 20:50:54 -0400 (Fri, 19 Oct 2007) New Revision: 316 Modified: trunk/bin/setclasspath.sh trunk/java/org/apache/catalina/servlets/LocalStrings.properties trunk/java/org/apache/catalina/servlets/WebdavServlet.java Log: - Add an entity resolver which forbids entities, just in case, until more investigations. Modified: trunk/bin/setclasspath.sh =================================================================== --- trunk/bin/setclasspath.sh 2007-10-18 21:01:52 UTC (rev 315) +++ trunk/bin/setclasspath.sh 2007-10-20 00:50:54 UTC (rev 316) @@ -14,12 +14,12 @@ if $darwin && [ -d "/System/Library/Frameworks/JavaVM.framework/Versions/1.5/Home" ]; then export JAVA_HOME="/System/Library/Frameworks/JavaVM.framework/Versions/1.5/Home" else - if [ ! -x /usr/bin/java ]; then + if [ -x /usr/bin/java ]; then + JRE_HOME=/usr + else echo "Neither the JAVA_HOME nor the JRE_HOME environment variable is defined" echo "At least one of these environment variable is needed to run this program" exit 1 - else - JRE_HOME=/usr fi fi fi Modified: trunk/java/org/apache/catalina/servlets/LocalStrings.properties =================================================================== --- trunk/java/org/apache/catalina/servlets/LocalStrings.properties 2007-10-18 21:01:52 UTC (rev 315) +++ trunk/java/org/apache/catalina/servlets/LocalStrings.properties 2007-10-20 00:50:54 UTC (rev 316) @@ -10,6 +10,7 @@ invokerServlet.notNamed=Cannot call invoker servlet with a named dispatcher invokerServlet.noWrapper=Container has not called setWrapper() for this servlet webdavservlet.jaxpfailed=JAXP initialization failed +webdavservlet.noentities=Entities are not allowed directory.filename=Filename directory.lastModified=Last Modified directory.parent=Up To {0} Modified: trunk/java/org/apache/catalina/servlets/WebdavServlet.java =================================================================== --- trunk/java/org/apache/catalina/servlets/WebdavServlet.java 2007-10-18 21:01:52 UTC (rev 315) +++ trunk/java/org/apache/catalina/servlets/WebdavServlet.java 2007-10-20 00:50:54 UTC (rev 316) @@ -57,6 +57,7 @@ import org.w3c.dom.Element; import org.w3c.dom.Node; import org.w3c.dom.NodeList; +import org.xml.sax.EntityResolver; import org.xml.sax.InputSource; import org.xml.sax.SAXException; @@ -245,6 +246,13 @@ documentBuilderFactory.setNamespaceAware(true); documentBuilderFactory.setExpandEntityReferences(false); documentBuilder = documentBuilderFactory.newDocumentBuilder(); + documentBuilder.setEntityResolver + (new EntityResolver() { + public InputSource resolveEntity(String publicId, String systemId) + throws SAXException, IOException { + throw new IllegalStateException(sm.getString("webdavservlet.noentities")); + } + }); } catch(ParserConfigurationException e) { throw new ServletException (sm.getString("webdavservlet.jaxpfailed"));