[jbossws-commits] JBossWS SVN: r9920 - common/branches/jbossws-common-1.0.0.GA_CP/src/main/java/org/jboss/wsf/common.

[jbossws-commits at lists.jboss.org]

Author: richard.opalka at jboss.com
Date: 2009-04-29 06:51:00 -0400 (Wed, 29 Apr 2009)
New Revision: 9920

Modified:
   common/branches/jbossws-common-1.0.0.GA_CP/src/main/java/org/jboss/wsf/common/DOMUtils.java
Log:
[JBWS-1582][JBPAPP-1961] backport - svn merge -r 9917:9918 https://svn.jboss.org/repos/jbossws/common/branches/jbossws-common-1.0.0.GA_CP03_JBPAPP-1961

Modified: common/branches/jbossws-common-1.0.0.GA_CP/src/main/java/org/jboss/wsf/common/DOMUtils.java
===================================================================
--- common/branches/jbossws-common-1.0.0.GA_CP/src/main/java/org/jboss/wsf/common/DOMUtils.java	2009-04-29 10:27:16 UTC (rev 9919)
+++ common/branches/jbossws-common-1.0.0.GA_CP/src/main/java/org/jboss/wsf/common/DOMUtils.java	2009-04-29 10:51:00 UTC (rev 9920)
@@ -33,6 +33,7 @@
 import java.util.Iterator;
 import java.util.Map;
 
+import javax.xml.XMLConstants;
 import javax.xml.namespace.QName;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
@@ -69,6 +70,7 @@
    private static Logger log = Logger.getLogger(DOMUtils.class);
 
    private static final String DISABLE_DEFERRED_NODE_EXPANSION = "org.jboss.ws.disable_deferred_node_expansion";
+   private static final String DEFER_NODE_EXPANSION_FEATURE = "http://apache.org/xml/features/dom/defer-node-expansion";
 
    // All elements created by the same thread are created by the same builder and belong to the same doc
    private static ThreadLocal<Document> documentThreadLocal = new ThreadLocal<Document>();
@@ -81,11 +83,18 @@
             factory.setValidating(false);
             factory.setNamespaceAware(true);
 
-            boolean disableDeferredNodeExpansion = Boolean.getBoolean(DISABLE_DEFERRED_NODE_EXPANSION);
-            if (disableDeferredNodeExpansion == true)
+            try
             {
-               factory.setFeature("http://apache.org/xml/features/dom/defer-node-expansion", false);
+               factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+               if (Boolean.getBoolean(DISABLE_DEFERRED_NODE_EXPANSION))
+               {
+                  factory.setFeature(DEFER_NODE_EXPANSION_FEATURE, false);
+               }
             }
+            catch (ParserConfigurationException pce)
+            {
+               log.error(pce);
+            }
 
             DocumentBuilder builder = factory.newDocumentBuilder();
             setEntityResolver(builder);