Author: richard.opalka(a)jboss.com Date: 2009-04-29 06:25:44 -0400 (Wed, 29 Apr 2009) New Revision: 9918 Modified: common/branches/jbossws-common-1.0.0.GA_CP03_JBPAPP-1961/src/main/java/org/jboss/wsf/common/DOMUtils.java Log: [JBWS-1582][JBPAPP-1961] backport Modified: common/branches/jbossws-common-1.0.0.GA_CP03_JBPAPP-1961/src/main/java/org/jboss/wsf/common/DOMUtils.java =================================================================== --- common/branches/jbossws-common-1.0.0.GA_CP03_JBPAPP-1961/src/main/java/org/jboss/wsf/common/DOMUtils.java 2009-04-29 06:50:03 UTC (rev 9917) +++ common/branches/jbossws-common-1.0.0.GA_CP03_JBPAPP-1961/src/main/java/org/jboss/wsf/common/DOMUtils.java 2009-04-29 10:25:44 UTC (rev 9918) @@ -33,6 +33,7 @@ import java.util.Iterator; import java.util.Map; +import javax.xml.XMLConstants; import javax.xml.namespace.QName; import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; @@ -69,6 +70,7 @@ private static Logger log = Logger.getLogger(DOMUtils.class); private static final String DISABLE_DEFERRED_NODE_EXPANSION = "org.jboss.ws.disable_deferred_node_expansion"; + private static final String DEFER_NODE_EXPANSION_FEATURE = "http://apache.org/xml/features/dom/defer-node-expansion"; // All elements created by the same thread are created by the same builder and belong to the same doc private static ThreadLocal<Document> documentThreadLocal = new ThreadLocal<Document>(); @@ -81,11 +83,18 @@ factory.setValidating(false); factory.setNamespaceAware(true); - boolean disableDeferredNodeExpansion = Boolean.getBoolean(DISABLE_DEFERRED_NODE_EXPANSION); - if (disableDeferredNodeExpansion == true) + try { - factory.setFeature("http://apache.org/xml/features/dom/defer-node-ex...;, false); + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); + if (Boolean.getBoolean(DISABLE_DEFERRED_NODE_EXPANSION)) + { + factory.setFeature(DEFER_NODE_EXPANSION_FEATURE, false); + } } + catch (ParserConfigurationException pce) + { + log.error(pce); + } DocumentBuilder builder = factory.newDocumentBuilder(); setEntityResolver(builder);