Author: manaRH Date: 2014-01-21 09:47:52 -0500 (Tue, 21 Jan 2014) New Revision: 15651 Modified: branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java branches/enterprise/WFK-2_1/jboss-seam/src/main/java/org/jboss/seam/util/XML.java Log: https://issues.jboss.org/browse/WFK2-375 enhanced fix Modified: branches/enterprise/WFK-2_1/jboss-seam/src/main/java/org/jboss/seam/util/XML.java =================================================================== --- branches/enterprise/WFK-2_1/jboss-seam/src/main/java/org/jboss/seam/util/XML.java 2014-01-21 14:46:38 UTC (rev 15650) +++ branches/enterprise/WFK-2_1/jboss-seam/src/main/java/org/jboss/seam/util/XML.java 2014-01-21 14:47:52 UTC (rev 15651) @@ -65,4 +65,17 @@ } } + + /** + * Get safe SaxReader with doctype feature disabled + * @see http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl + * @return + * @throws Exception + */ + public static SAXReader getSafeSaxReader() throws Exception + { + SAXReader xmlReader = new SAXReader(); + xmlReader.setFeature("http://apache.org/xml/features/disallow-doctyp...;, true); + return xmlReader; + } } Modified: branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java =================================================================== --- branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java 2014-01-21 14:46:38 UTC (rev 15650) +++ branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java 2014-01-21 14:47:52 UTC (rev 15651) @@ -21,6 +21,7 @@ import org.jboss.seam.log.Logging; import org.jboss.seam.remoting.wrapper.Wrapper; import org.jboss.seam.servlet.ContextualHttpServletRequest; +import org.jboss.seam.util.XML; /** * Unmarshals the calls from an HttpServletRequest, executes them in order and @@ -67,7 +68,7 @@ log.debug("Processing remote request: " + requestData); // Parse the incoming request as XML - SAXReader xmlReader = new SAXReader(); + SAXReader xmlReader = XML.getSafeSaxReader(); Document doc = xmlReader.read( new StringReader(requestData) ); final Element env = doc.getRootElement(); final RequestContext ctx = unmarshalContext(env); Modified: branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java =================================================================== --- branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java 2014-01-21 14:46:38 UTC (rev 15650) +++ branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java 2014-01-21 14:47:52 UTC (rev 15651) @@ -88,16 +88,8 @@ Component component = Component.forName(componentName); if (component == null) { - try - { - Class c = Reflections.classForName(componentName); - appendClassSource(response.getOutputStream(), c, types); - } - catch (ClassNotFoundException ex) - { - log.error(String.format("Component not found: [%s]", componentName)); - throw new ServletException("Invalid request - component not found."); - } + log.error(String.format("Component not found: [%s]", componentName)); + throw new ServletException("Invalid request - component not found."); } else { Modified: branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java =================================================================== --- branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java 2014-01-21 14:46:38 UTC (rev 15650) +++ branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java 2014-01-21 14:47:52 UTC (rev 15651) @@ -21,6 +21,7 @@ import org.jboss.seam.remoting.messaging.PollRequest; import org.jboss.seam.remoting.wrapper.Wrapper; import org.jboss.seam.servlet.ContextualHttpServletRequest; +import org.jboss.seam.util.XML; /** * Handles JMS Message poll requests. @@ -56,7 +57,7 @@ response.setContentType("text/xml"); // Parse the incoming request as XML - SAXReader xmlReader = new SAXReader(); + SAXReader xmlReader = XML.getSafeSaxReader(); Document doc = xmlReader.read(request.getInputStream()); Element env = doc.getRootElement(); Modified: branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java =================================================================== --- branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java 2014-01-21 14:46:38 UTC (rev 15650) +++ branches/enterprise/WFK-2_1/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java 2014-01-21 14:47:52 UTC (rev 15651) @@ -17,6 +17,7 @@ import org.jboss.seam.remoting.messaging.RemoteSubscriber; import org.jboss.seam.remoting.messaging.SubscriptionRegistry; import org.jboss.seam.remoting.messaging.SubscriptionRequest; +import org.jboss.seam.util.XML; import org.jboss.seam.web.ServletContexts; /** @@ -40,7 +41,7 @@ response.setContentType("text/xml"); // Parse the incoming request as XML - SAXReader xmlReader = new SAXReader(); + SAXReader xmlReader = XML.getSafeSaxReader(); Document doc = xmlReader.read(request.getInputStream()); Element env = doc.getRootElement();