public static SAXParser buildSecureSaxParser ( InputStream ... schemaStream ) throws ParserConfigurationException , SAXNotRecognizedException , SAXNotSupportedException , SAXException { final SAXParserFactory factory = SAXParserFactory . newInstance ( ) ; factory . setNamespaceAware ( true ) ; factory . setValidating ( true ) ; factory . setFeature ( "http://apache.org/xml/features/disallow-doctype-decl" , true ) ; factory . setFeature ( "http://xml.org/sax/features/external-general-entities" , false ) ; //setting the following unfortunately breaks reading the old suppression files (version 1). //factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); final SAXParser saxParser = factory . newSAXParser ( ) ; saxParser . setProperty ( JAXP_SCHEMA_LANGUAGE , W3C_XML_SCHEMA ) ; saxParser . setProperty ( JAXP_SCHEMA_SOURCE , schemaStream ) ; return saxParser ; }
Constructs a validating secure SAX Parser .