Class DefaultSafeXmlParserFactory

java.lang.Object
com.itextpdf.kernel.utils.DefaultSafeXmlParserFactory
All Implemented Interfaces:
IXmlParserFactory

public class DefaultSafeXmlParserFactory extends Object implements IXmlParserFactory
Implementation of IXmlParserFactory for creating safe xml parser objects. Creates parsers with configuration to prevent XML bombs and XXE attacks.
  • Field Details

    • LOGGER

      private static final org.slf4j.Logger LOGGER
    • DISALLOW_DOCTYPE_DECL

      private static final String DISALLOW_DOCTYPE_DECL
      Feature for disallowing DOCTYPE declaration.

      Xerces 2 only - http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl

      See Also:
    • EXTERNAL_GENERAL_ENTITIES

      private static final String EXTERNAL_GENERAL_ENTITIES
      If you can't disable DOCTYPE declarations, then at least disable external entities. Must be used with the EXTERNAL_PARAMETER_ENTITIES, otherwise has no effect.

      Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities JDK7+ - http://xml.org/sax/features/external-general-entities

      See Also:
    • EXTERNAL_PARAMETER_ENTITIES

      private static final String EXTERNAL_PARAMETER_ENTITIES
      Must be used with the EXTERNAL_GENERAL_ENTITIES, otherwise has no effect.

      Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities JDK7+ - http://xml.org/sax/features/external-parameter-entities

      See Also:
    • LOAD_EXTERNAL_DTD

      private static final String LOAD_EXTERNAL_DTD
      Disable external DTDs.
      See Also:
  • Constructor Details

  • Method Details