private static Source createSafeSource ( XMLReader reader , InputSource source ) { try { reader . setFeature ( "http://xml.org/sax/features/external-general-entities" , false ) ; } catch ( SAXException ignored ) { /* Fallback entity resolver will be used */ } try { reader . setFeature ( "http://xml.org/sax/features/external-parameter-entities" , false ) ; } catch ( SAXException ignored ) { /* Fallback entity resolver will be used */ } // Fallback in case the above features are not supported by the underlying XML library. reader . setEntityResolver ( ( publicId , systemId ) -> { return new InputSource ( new ByteArrayInputStream ( XXE_MARKER . getBytes ( StandardCharsets . US_ASCII ) ) ) ; } ) ; return new SAXSource ( reader , source ) ; }
Converts a Source into a Source that is protected against XXE attacks .