jdk-sandbox: comparison jaxp/src/com/sun/org/apache/xerces/internal/impl/XMLDocumentFragmentScannerImpl.java

equal deleted inserted replaced

-:93a2cadbbd33
+:21dc0b2762da
 import com.sun.org.apache.xerces.internal.xni.Augmentations;
 import com.sun.org.apache.xerces.internal.impl.Constants;
 import com.sun.org.apache.xerces.internal.impl.XMLEntityHandler;
 import com.sun.org.apache.xerces.internal.util.SecurityManager;
 import com.sun.org.apache.xerces.internal.util.NamespaceSupport;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import com.sun.org.apache.xerces.internal.xni.NamespaceContext;
+import com.sun.xml.internal.stream.Entity;
+import javax.xml.XMLConstants;
 import javax.xml.stream.XMLStreamConstants;
 import javax.xml.stream.events.XMLEvent;
 /**
 *
 /** Property identifier: entity resolver. */
 protected static final String ENTITY_RESOLVER =
 Constants.XERCES_PROPERTY_PREFIX + Constants.ENTITY_RESOLVER_PROPERTY;
+/** Feature identifier: standard uri conformant */
+protected static final String STANDARD_URI_CONFORMANT =
+Constants.XERCES_FEATURE_PREFIX +Constants.STANDARD_URI_CONFORMANT_FEATURE;
+/** property identifier: access external dtd. */
+protected static final String ACCESS_EXTERNAL_DTD = XMLConstants.ACCESS_EXTERNAL_DTD;
+/** access external dtd: file protocol
+*  For DOM/SAX, the secure feature is set to true by default
+*/
+final static String EXTERNAL_ACCESS_DEFAULT = Constants.EXTERNAL_ACCESS_DEFAULT;
 // recognized features and properties
 /** Recognized features. */
 private static final String[] RECOGNIZED_FEATURES = {
 NAMESPACES,
 /** Recognized properties. */
 private static final String[] RECOGNIZED_PROPERTIES = {
 SYMBOL_TABLE,
 ERROR_REPORTER,
 ENTITY_MANAGER,
+ACCESS_EXTERNAL_DTD
 };
 /** Property defaults. */
 private static final Object[] PROPERTY_DEFAULTS = {
 null,
 null,
 null,
+EXTERNAL_ACCESS_DEFAULT
 };
 private static final char [] cdata = {'[','C','D','A','T','A','['};
 private static final char [] endTag = {'<','/'};
 protected boolean fReportCdataEvent = false ;
 protected boolean fIsCoalesce = false ;
 protected String fDeclaredEncoding =  null;
 /** Xerces Feature: Disallow doctype declaration. */
 protected boolean fDisallowDoctype = false;
+/**
+* comma-delimited list of protocols that are allowed for the purpose
+* of accessing external dtd or entity references
+*/
+protected String fAccessExternalDTD = EXTERNAL_ACCESS_DEFAULT;
+/**
+* standard uri conformant (strict uri).
+* http://apache.org/xml/features/standard-uri-conformant
+*/
+protected boolean fStrictURI;
 // drivers
 /** Active driver. */
 protected Driver fDriver;
 *                 permitted to completely scan a document if it does
 *                 not support this "pull" scanning model.
 *
 * @return True if there is more to scan, false otherwise.
 */
-/* public boolean scanDocument(boolean complete)
-throws IOException, XNIException {
-// keep dispatching "events"
-fEntityManager.setEntityHandler(this);
-return true;
-} // scanDocument(boolean):boolean
-*/
 public boolean scanDocument(boolean complete)
 throws IOException, XNIException {
 // keep dispatching "events"
 fEntityManager.setEntityHandler(this);
 //attribute
 fReadingAttributes = false;
 //xxx: external entities are supported in Xerces
 // it would be good to define feature for this case
 fSupportExternalEntities = true;
+fSupportExternalEntities = true;
+fSupportExternalEntities = true;
+fSupportExternalEntities = true;
 fReplaceEntityReferences = true;
 fIsCoalesce = false;
 // setup Driver
 setScannerState(SCANNER_STATE_CONTENT);
 setDriver(fContentDriver);
 fEntityStore = fEntityManager.getEntityStore();
 dtdGrammarUtil = null;
+// JAXP 1.5 features and properties
+fAccessExternalDTD = (String) componentManager.getProperty(ACCESS_EXTERNAL_DTD, EXTERNAL_ACCESS_DEFAULT);
+fStrictURI = componentManager.getFeature(STANDARD_URI_CONFORMANT, false);
 //fEntityManager.test();
 } // reset(XMLComponentManager)
 fEntityStore = fEntityManager.getEntityStore();
 //fEntityManager.test();
 dtdGrammarUtil = null;
+// Oracle jdk feature
+fAccessExternalDTD = (String) propertyManager.getProperty(ACCESS_EXTERNAL_DTD);
 } // reset(XMLComponentManager)
 /**
 * Returns a list of feature identifiers that are recognized by
 * this component. This method may return null if no features
 String property = propertyId.substring(Constants.XERCES_PROPERTY_PREFIX.length());
 if (property.equals(Constants.ENTITY_MANAGER_PROPERTY)) {
 fEntityManager = (XMLEntityManager)value;
 }
 return;
+}
+//JAXP 1.5 properties
+if (propertyId.startsWith(Constants.JAXPAPI_PROPERTY_PREFIX)) {
+if (propertyId.equals(ACCESS_EXTERNAL_DTD))
+{
+fAccessExternalDTD = (String)value;
+}
 }
 } // setProperty(String,Object)
 /**
 }
 //1. if the entity is external and support to external entities is not required
 // 2. or entities should not be replaced
 //3. or if it is built in entity reference.
-if((fEntityStore.isExternalEntity(name) && !fSupportExternalEntities) || (!fEntityStore.isExternalEntity(name) && !fReplaceEntityReferences) || foundBuiltInRefs){
+boolean isEE = fEntityStore.isExternalEntity(name);
+if((isEE && !fSupportExternalEntities) || (!isEE && !fReplaceEntityReferences) || foundBuiltInRefs){
 fScannerState = SCANNER_STATE_REFERENCE;
 return ;
 }
 // start general entity
 if (!fEntityStore.isDeclaredEntity(name)) {
 }
 }
 return "null";
 } // getDriverName():String
+String checkAccess(String systemId, String allowedProtocols) throws IOException {
+String baseSystemId = fEntityScanner.getBaseSystemId();
+String expandedSystemId = fEntityManager.expandSystemId(systemId, baseSystemId,fStrictURI);
+return SecuritySupport.checkAccess(expandedSystemId, allowedProtocols, Constants.ACCESS_EXTERNAL_ALL);
+}
 //
 // Classes
 //

changeset 17534	21dc0b2762da
parent 14939	2e992d2acc8b
child 18890	25bdeca3173b
child 20964	a5cd729f176d