@@ -54,30 +54,28 @@ public static XMLFactorySAX newInstanceSecure(boolean validating) throws XMLExce
5454 return newInstanceSecure (validating , false );
5555 }
5656
57- public static SAXParserFactory disableExternalEntity (SAXParserFactory saxFac ) throws XMLException {
58- return XMLException .get ( () -> {
59- saxFac .setFeature ("http://apache.org/xml/features/disallow-doctype-decl" , true );
60- saxFac .setFeature ("http://xml.org/sax/features/external-general-entities" , false );
61- saxFac .setFeature ("http://xml.org/sax/features/external-parameter-entities" , false );
62- saxFac .setFeature ("http://apache.org/xml/features/nonvalidating/load-external-dtd" , false );
63- saxFac .setXIncludeAware (false );
64- return saxFac ;
65- } );
66- }
67-
68- private static SAXParserFactory init ( boolean validating , boolean namespaceAware ) {
69- SAXParserFactory saxFac = SAXParserFactory .newInstance ();
70- saxFac .setValidating (validating );
71- saxFac .setNamespaceAware (namespaceAware );
72- return saxFac ;
57+ public static XMLFactorySAX newInstanceSecure (boolean validating , boolean namespaceAware ) throws XMLException {
58+ return newInstance ( validating , namespaceAware , Boolean .TRUE );
7359 }
7460
75- public static XMLFactorySAX newInstanceSecure (boolean validating , boolean namespaceAware ) throws XMLException {
76- return new XMLFactorySAX ( disableExternalEntity ( init ( validating , namespaceAware ) ) );
61+ public static XMLFactorySAX newInstance (boolean validating , boolean namespaceAware ) throws XMLException {
62+ return newInstance ( validating , namespaceAware , Boolean . FALSE );
7763 }
7864
79- public static XMLFactorySAX newInstance (boolean validating , boolean namespaceAware ) {
80- return new XMLFactorySAX ( init ( validating , namespaceAware ) );
65+ public static XMLFactorySAX newInstance (boolean validating , boolean namespaceAware , boolean secure ) throws XMLException {
66+ return XMLException .get ( () -> {
67+ SAXParserFactory factory = SAXParserFactory .newInstance ();
68+ factory .setValidating (validating );
69+ factory .setNamespaceAware (namespaceAware );
70+ if ( secure ) {
71+ factory .setFeature ("http://apache.org/xml/features/disallow-doctype-decl" , true );
72+ factory .setFeature ("http://xml.org/sax/features/external-general-entities" , false );
73+ factory .setFeature ("http://xml.org/sax/features/external-parameter-entities" , false );
74+ factory .setFeature ("http://apache.org/xml/features/nonvalidating/load-external-dtd" , false );
75+ factory .setXIncludeAware (false );
76+ }
77+ return new XMLFactorySAX ( factory );
78+ } );
8179 }
8280
8381 public void setValidating (boolean val ) {
0 commit comments