[OLINGO-1409] XML serializer defaults

apache · Nov 12, 2019 · 5948974 · 5948974
1 parent ae416b5
commit 5948974
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 7 deletions.
diff --git a/lib/server-core-ext/src/main/java/org/apache/olingo/server/core/MetadataParser.java b/lib/server-core-ext/src/main/java/org/apache/olingo/server/core/MetadataParser.java
@@ -162,25 +162,25 @@ public ServiceMetadata buildServiceMetadata(Reader csdl) throws XMLStreamExcepti
   }
 
   public SchemaBasedEdmProvider buildEdmProvider(Reader csdl) throws XMLStreamException {
-    XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
+    XMLInputFactory xmlInputFactory = createXmlInputFactory();
     XMLEventReader reader = xmlInputFactory.createXMLEventReader(csdl);    
     return buildEdmProvider(reader, this.referenceResolver, this.implicitlyLoadCoreVocabularies,
             this.useLocalCoreVocabularies, true, null);
   }
 
   public SchemaBasedEdmProvider addToEdmProvider(SchemaBasedEdmProvider existing, Reader csdl)
       throws XMLStreamException {
-    XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
+    XMLInputFactory xmlInputFactory = createXmlInputFactory();
     XMLEventReader reader = xmlInputFactory.createXMLEventReader(csdl);
     return addToEdmProvider(existing, reader, this.referenceResolver, this.implicitlyLoadCoreVocabularies,
         this.useLocalCoreVocabularies, true, null);
   }
-  
+
   protected SchemaBasedEdmProvider buildEdmProvider(Reader csdl, ReferenceResolver resolver,
                                                     boolean loadCore, boolean useLocal,
                                                     boolean loadReferenceSchemas, String namespace)
           throws XMLStreamException {
-    XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
+    XMLInputFactory xmlInputFactory = createXmlInputFactory();
     XMLEventReader reader = xmlInputFactory.createXMLEventReader(csdl);
     return buildEdmProvider(reader, resolver, loadCore, useLocal, loadReferenceSchemas, namespace);
   }
@@ -189,7 +189,7 @@ protected SchemaBasedEdmProvider buildEdmProvider(InputStream csdl, ReferenceRes
                                                     boolean loadCore, boolean useLocal,
                                                     boolean loadReferenceSchemas, String namespace)
           throws XMLStreamException {
-    XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
+    XMLInputFactory xmlInputFactory = createXmlInputFactory();
     XMLEventReader reader = xmlInputFactory.createXMLEventReader(csdl);
     return buildEdmProvider(reader, resolver, loadCore, useLocal, loadReferenceSchemas, namespace);
   } 
@@ -249,8 +249,15 @@ void build(XMLEventReader reader, StartElement element, SchemaBasedEdmProvider p
           : fixXmlBase(xmlBase.toString()), resolver, loadCore, useLocal);
     }
     return provider;
-  }  
-
+  }
+
+  private XMLInputFactory createXmlInputFactory() {
+    XMLInputFactory factory = XMLInputFactory.newInstance();
+    factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+    factory.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
+    return factory;
+  }
+
   private void loadReferencesSchemas(SchemaBasedEdmProvider provider,
       String xmlBase, ReferenceResolver resolver, boolean loadCore,
       boolean useLocal) {    

diff --git a/...re/src/main/java/org/apache/olingo/server/core/deserializer/xml/ODataXmlDeserializer.java b/...re/src/main/java/org/apache/olingo/server/core/deserializer/xml/ODataXmlDeserializer.java
@@ -94,6 +94,8 @@ public void setMetadata(ServiceMetadata metadata) {
   }
 
   protected XMLEventReader getReader(final InputStream input) throws XMLStreamException {
+    FACTORY.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+    FACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
     return FACTORY.createXMLEventReader(input);
   }