Author: richard.opalka(a)jboss.com Date: 2009-04-29 06:51:00 -0400 (Wed, 29 Apr 2009) New Revision: 9920 Modified: common/branches/jbossws-common-1.0.0.GA_CP/src/main/java/org/jboss/wsf/common/DOMUtils.java Log: [JBWS-1582][JBPAPP-1961] backport - svn merge -r 9917:9918 https://svn.jboss.org/repos/jbossws/common/branches/jbossws-common-1.0.0.... Modified: common/branches/jbossws-common-1.0.0.GA_CP/src/main/java/org/jboss/wsf/common/DOMUtils.java =================================================================== --- common/branches/jbossws-common-1.0.0.GA_CP/src/main/java/org/jboss/wsf/common/DOMUtils.java 2009-04-29 10:27:16 UTC (rev 9919) +++ common/branches/jbossws-common-1.0.0.GA_CP/src/main/java/org/jboss/wsf/common/DOMUtils.java 2009-04-29 10:51:00 UTC (rev 9920) @@ -33,6 +33,7 @@ import java.util.Iterator; import java.util.Map; +import javax.xml.XMLConstants; import javax.xml.namespace.QName; import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; @@ -69,6 +70,7 @@ private static Logger log = Logger.getLogger(DOMUtils.class); private static final String DISABLE_DEFERRED_NODE_EXPANSION = "org.jboss.ws.disable_deferred_node_expansion"; + private static final String DEFER_NODE_EXPANSION_FEATURE = "http://apache.org/xml/features/dom/defer-node-expansion"; // All elements created by the same thread are created by the same builder and belong to the same doc private static ThreadLocal<Document> documentThreadLocal = new ThreadLocal<Document>(); @@ -81,11 +83,18 @@ factory.setValidating(false); factory.setNamespaceAware(true); - boolean disableDeferredNodeExpansion = Boolean.getBoolean(DISABLE_DEFERRED_NODE_EXPANSION); - if (disableDeferredNodeExpansion == true) + try { - factory.setFeature("http://apache.org/xml/features/dom/defer-node-ex...;, false); + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); + if (Boolean.getBoolean(DISABLE_DEFERRED_NODE_EXPANSION)) + { + factory.setFeature(DEFER_NODE_EXPANSION_FEATURE, false); + } } + catch (ParserConfigurationException pce) + { + log.error(pce); + } DocumentBuilder builder = factory.newDocumentBuilder(); setEntityResolver(builder);