org.dromara.hutool.core.xml

Class XXEUtil

java.lang.Object

org.dromara.hutool.core.xml.XXEUtil

public class XXEUtil
extends Object

XXE漏洞修复相关工具类
参考：https://blog.spoock.com/2018/10/23/java-xxe/

Since:

6.0.0

Author:

looly

Constructor Summary

Constructors

Constructor and Description
XXEUtil()

Method Summary

Modifier and Type	Method and Description
static DocumentBuilderFactory	disableXXE(DocumentBuilderFactory factory) 关闭XXE，避免漏洞攻击 see: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#JAXP_DocumentBuilderFactory.2C_SAXParserFactory_and_DOM4J
static SAXParserFactory	disableXXE(SAXParserFactory factory) 关闭XEE避免漏洞攻击
static SAXTransformerFactory	disableXXE(SAXTransformerFactory factory) 关闭XEE避免漏洞攻击
static SchemaFactory	disableXXE(SchemaFactory factory) 关闭XEE避免漏洞攻击
static TransformerFactory	disableXXE(TransformerFactory factory) 关闭XEE避免漏洞攻击
static Validator	disableXXE(Validator validator) 关闭XEE避免漏洞攻击
static XMLReader	disableXXE(XMLReader reader) 关闭XEE避免漏洞攻击

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

XXEUtil

public XXEUtil()

Method Detail

disableXXE

public static DocumentBuilderFactory disableXXE(DocumentBuilderFactory factory)

关闭XXE，避免漏洞攻击
see: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#JAXP_DocumentBuilderFactory.2C_SAXParserFactory_and_DOM4J

Parameters:

factory - DocumentBuilderFactory

Returns:

DocumentBuilderFactory

disableXXE

public static SAXParserFactory disableXXE(SAXParserFactory factory)

关闭XEE避免漏洞攻击

Parameters:

factory - SAXParserFactory

Returns:

SAXParserFactory

disableXXE

public static XMLReader disableXXE(XMLReader reader)

关闭XEE避免漏洞攻击

Parameters:

reader - XMLReader

Returns:

XMLReader

disableXXE

public static TransformerFactory disableXXE(TransformerFactory factory)

关闭XEE避免漏洞攻击

Parameters:

factory - TransformerFactory

Returns:

TransformerFactory

disableXXE

public static Validator disableXXE(Validator validator)

关闭XEE避免漏洞攻击

Parameters:

validator - Validator

Returns:

Validator

disableXXE

public static SAXTransformerFactory disableXXE(SAXTransformerFactory factory)

关闭XEE避免漏洞攻击

Parameters:

factory - SAXTransformerFactory

Returns:

SAXTransformerFactory

disableXXE

public static SchemaFactory disableXXE(SchemaFactory factory)

关闭XEE避免漏洞攻击

Parameters:

factory - SchemaFactory

Returns:

SchemaFactory