59 * <http://www.apache.org/>. |
59 * <http://www.apache.org/>. |
60 */ |
60 */ |
61 |
61 |
62 package com.sun.org.apache.xerces.internal.util; |
62 package com.sun.org.apache.xerces.internal.util; |
63 import com.sun.org.apache.xerces.internal.impl.Constants; |
63 import com.sun.org.apache.xerces.internal.impl.Constants; |
|
64 import java.security.AccessController; |
|
65 import java.security.PrivilegedAction; |
64 /** |
66 /** |
65 * This class is a container for parser settings that relate to |
67 * This class is a container for parser settings that relate to |
66 * security, or more specifically, it is intended to be used to prevent denial-of-service |
68 * security, or more specifically, it is intended to be used to prevent denial-of-service |
67 * attacks from being launched against a system running Xerces. |
69 * attacks from being launched against a system running Xerces. |
68 * Any component that is aware of a denial-of-service attack that can arise |
70 * Any component that is aware of a denial-of-service attack that can arise |
75 * will provide defaults for all known security issues, but will also provide |
77 * will provide defaults for all known security issues, but will also provide |
76 * setters so that those values can be tailored by applications that care. |
78 * setters so that those values can be tailored by applications that care. |
77 * |
79 * |
78 * @author Neil Graham, IBM |
80 * @author Neil Graham, IBM |
79 * |
81 * |
|
82 * @version $Id: SecurityManager.java,v 1.5 2010-11-01 04:40:14 joehw Exp $ |
80 */ |
83 */ |
81 public final class SecurityManager { |
84 public final class SecurityManager { |
82 |
85 |
83 // |
86 // |
84 // Constants |
87 // Constants |
174 fElementAttributeLimit = limit; |
177 fElementAttributeLimit = limit; |
175 } |
178 } |
176 |
179 |
177 private void readSystemProperties(){ |
180 private void readSystemProperties(){ |
178 |
181 |
179 //TODO: also read SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT |
182 //TODO: also read SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT |
180 try { |
183 try { |
181 String value = System.getProperty(Constants.ENTITY_EXPANSION_LIMIT); |
184 String value = getSystemProperty(Constants.ENTITY_EXPANSION_LIMIT); |
182 if(value != null && !value.equals("")){ |
185 if(value != null && !value.equals("")){ |
183 entityExpansionLimit = Integer.parseInt(value); |
186 entityExpansionLimit = Integer.parseInt(value); |
184 if (entityExpansionLimit < 0) |
187 if (entityExpansionLimit < 0) |
185 entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT; |
188 entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT; |
186 } |
189 } |
187 else |
190 else |
188 entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT; |
191 entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT; |
|
192 }catch(Exception ex){} |
|
193 |
|
194 try { |
|
195 String value = getSystemProperty(Constants.MAX_OCCUR_LIMIT); |
|
196 if(value != null && !value.equals("")){ |
|
197 maxOccurLimit = Integer.parseInt(value); |
|
198 if (maxOccurLimit < 0) |
|
199 maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT; |
|
200 } |
|
201 else |
|
202 maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT; |
|
203 }catch(Exception ex){} |
|
204 |
|
205 try { |
|
206 String value = getSystemProperty(Constants.SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT); |
|
207 if(value != null && !value.equals("")){ |
|
208 fElementAttributeLimit = Integer.parseInt(value); |
|
209 if ( fElementAttributeLimit < 0) |
|
210 fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT; |
|
211 } |
|
212 else |
|
213 fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT; |
|
214 |
189 }catch(Exception ex){} |
215 }catch(Exception ex){} |
190 |
216 |
191 try { |
|
192 String value = System.getProperty(Constants.MAX_OCCUR_LIMIT); |
|
193 if(value != null && !value.equals("")){ |
|
194 maxOccurLimit = Integer.parseInt(value); |
|
195 if (maxOccurLimit < 0) |
|
196 maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT; |
|
197 } |
|
198 else |
|
199 maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT; |
|
200 }catch(Exception ex){} |
|
201 |
|
202 try { |
|
203 String value = System.getProperty(Constants.SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT); |
|
204 if(value != null && !value.equals("")){ |
|
205 fElementAttributeLimit = Integer.parseInt(value); |
|
206 if ( fElementAttributeLimit < 0) |
|
207 fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT; |
|
208 } |
|
209 else |
|
210 fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT; |
|
211 |
|
212 }catch(Exception ex){} |
|
213 |
|
214 } |
217 } |
215 |
218 |
|
219 private String getSystemProperty(final String propName) { |
|
220 return AccessController.doPrivileged(new PrivilegedAction<String>() { |
|
221 public String run() { |
|
222 return System.getProperty(propName); |
|
223 } |
|
224 }); |
|
225 } |
216 } // class SecurityManager |
226 } // class SecurityManager |