Example usage for javax.xml.parsers DocumentBuilderFactory setExpandEntityReferences

List of usage examples for javax.xml.parsers DocumentBuilderFactory setExpandEntityReferences

  1. HOME
  2. Java
  3. javax
  4. javax.xml.parsers.*
  5. DocumentBuilderFactory
  6. setExpandEntityReferences

Introduction

In this page you can find the example usage for javax.xml.parsers DocumentBuilderFactory setExpandEntityReferences.

Prototype


public void setExpandEntityReferences(boolean expandEntityRef)

Source Link

Document

Specifies that the parser produced by this code will expand entity reference nodes.

Usage

From source file:org.wso2.carbon.identity.application.authenticator.passive.sts.manager.PassiveSTSManager.java

/**
 * @param samlString/*from   w  w w.j a v  a2 s .  c  om*/
 * @return
 * @throws PassiveSTSException
 */
private XMLObject unmarshall(String samlString) throws PassiveSTSException {

    String samlStr = decodeHTMLCharacters(samlString);
    try {
        DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
        documentBuilderFactory.setNamespaceAware(true);

        documentBuilderFactory.setExpandEntityReferences(false);
        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        SecurityManager securityManager = new SecurityManager();
        securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
        documentBuilderFactory.setAttribute(SECURITY_MANAGER_PROPERTY, securityManager);

        DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();
        docBuilder.setEntityResolver(new CarbonEntityResolver());
        ByteArrayInputStream is = new ByteArrayInputStream(samlStr.getBytes(Charset.forName("UTF-8")));
        Document document = docBuilder.parse(is);
        Element element = document.getDocumentElement();

        NodeList nodeList = element.getElementsByTagNameNS("http://docs.oasis-open.org/ws-sx/ws-trust/200512",
                "RequestedSecurityToken");
        if (nodeList == null || nodeList.getLength() == 0) {
            throw new PassiveSTSException("Security Token is not found in the Response");
        }

        if (nodeList.getLength() > 1) {
            log.warn("More than one Security Token is found in the Response");
        }

        Element node = (Element) nodeList.item(0).getFirstChild();
        UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
        Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(node);
        return unmarshaller.unmarshall(node);
    } catch (ParserConfigurationException e) {
        throw new PassiveSTSException(
                PassiveSTSConstants.ERROR_IN_UNMARSHALLING_SAML_REQUEST_FROM_THE_ENCODED_STRING, e);
    } catch (UnmarshallingException e) {
        throw new PassiveSTSException(
                PassiveSTSConstants.ERROR_IN_UNMARSHALLING_SAML_REQUEST_FROM_THE_ENCODED_STRING, e);
    } catch (SAXException e) {
        throw new PassiveSTSException(
                PassiveSTSConstants.ERROR_IN_UNMARSHALLING_SAML_REQUEST_FROM_THE_ENCODED_STRING, e);
    } catch (IOException e) {
        throw new PassiveSTSException(
                PassiveSTSConstants.ERROR_IN_UNMARSHALLING_SAML_REQUEST_FROM_THE_ENCODED_STRING, e);
    }

}

From source file:org.wso2.carbon.identity.application.authenticator.samlsso.manager.DefaultSAML2SSOManager.java

private XMLObject unmarshall(String samlString) throws SAMLSSOException {

    try {/*from   w  ww .  jav  a 2s . c  om*/
        DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
        documentBuilderFactory.setNamespaceAware(true);
        documentBuilderFactory.setExpandEntityReferences(false);
        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        org.apache.xerces.util.SecurityManager securityManager = new SecurityManager();
        securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
        documentBuilderFactory.setAttribute(SECURITY_MANAGER_PROPERTY, securityManager);

        DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();
        docBuilder.setEntityResolver(new CarbonEntityResolver());
        ByteArrayInputStream is = new ByteArrayInputStream(samlString.getBytes());
        Document document = docBuilder.parse(is);
        Element element = document.getDocumentElement();
        UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
        Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);
        return unmarshaller.unmarshall(element);
    } catch (ParserConfigurationException e) {
        throw new SAMLSSOException("Error in unmarshalling SAML Request from the encoded String", e);
    } catch (UnmarshallingException e) {
        throw new SAMLSSOException("Error in unmarshalling SAML Request from the encoded String", e);
    } catch (SAXException e) {
        throw new SAMLSSOException("Error in unmarshalling SAML Request from the encoded String", e);
    } catch (IOException e) {
        throw new SAMLSSOException("Error in unmarshalling SAML Request from the encoded String", e);
    }

}

From source file:org.wso2.carbon.identity.auth.saml2.common.SAML2AuthUtils.java

public static XMLObject unmarshall(String samlString) throws IdentityRuntimeException {

    try {/* ww  w  . ja  va 2 s.  co  m*/
        DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
        documentBuilderFactory.setNamespaceAware(true);
        documentBuilderFactory.setExpandEntityReferences(false);
        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        org.apache.xerces.util.SecurityManager securityManager = new org.apache.xerces.util.SecurityManager();
        securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
        documentBuilderFactory.setAttribute(SECURITY_MANAGER_PROPERTY, securityManager);

        DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();
        docBuilder.setEntityResolver(new CarbonEntityResolver());
        ByteArrayInputStream is = new ByteArrayInputStream(samlString.getBytes(StandardCharsets.UTF_8));
        Document document = docBuilder.parse(is);
        Element element = document.getDocumentElement();
        UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
        Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);
        return unmarshaller.unmarshall(element);
    } catch (ParserConfigurationException e) {
        throw new IdentityRuntimeException("Error in unmarshalling SAML Request from the encoded String", e);
    } catch (UnmarshallingException e) {
        throw new IdentityRuntimeException("Error in unmarshalling SAML Request from the encoded String", e);
    } catch (SAXException e) {
        throw new IdentityRuntimeException("Error in unmarshalling SAML Request from the encoded String", e);
    } catch (IOException e) {
        throw new IdentityRuntimeException("Error in unmarshalling SAML Request from the encoded String", e);
    }
}

From source file:org.wso2.carbon.identity.authenticator.saml2.sso.common.Util.java

/**
 * Constructing the XMLObject Object from a String
 *
 * @param authReqStr//  w  w w . java2 s.  c  o m
 * @return Corresponding XMLObject which is a SAML2 object
 * @throws SAML2SSOUIAuthenticatorException
 */
public static XMLObject unmarshall(String authReqStr) throws SAML2SSOUIAuthenticatorException {

    try {
        doBootstrap();
        DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
        documentBuilderFactory.setNamespaceAware(true);

        documentBuilderFactory.setExpandEntityReferences(false);
        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        SecurityManager securityManager = new SecurityManager();
        securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
        documentBuilderFactory.setAttribute(SECURITY_MANAGER_PROPERTY, securityManager);

        DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();
        docBuilder.setEntityResolver(new CarbonEntityResolver());
        Document document = docBuilder.parse(new ByteArrayInputStream(authReqStr.trim().getBytes()));
        Element element = document.getDocumentElement();
        UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
        Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);
        return unmarshaller.unmarshall(element);
    } catch (Exception e) {
        log.error("Error in constructing AuthRequest from the encoded String", e);
        throw new SAML2SSOUIAuthenticatorException(
                "Error in constructing AuthRequest from " + "the encoded String ", e);
    }
}

From source file:org.wso2.carbon.identity.authenticator.saml2.sso.util.Util.java

/**
 * Constructing the XMLObject Object from a String
 *
 * @param authReqStr//from  w  w w.j a  v a 2 s.  co m
 * @return Corresponding XMLObject which is a SAML2 object
 * @throws org.wso2.carbon.identity.authenticator.saml2.sso.SAML2SSOAuthenticatorException
 */
public static XMLObject unmarshall(String authReqStr) throws SAML2SSOAuthenticatorException {

    XMLObject response;
    try {
        doBootstrap();
        DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
        documentBuilderFactory.setNamespaceAware(true);

        documentBuilderFactory.setExpandEntityReferences(false);
        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        SecurityManager securityManager = new SecurityManager();
        securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
        documentBuilderFactory.setAttribute(SECURITY_MANAGER_PROPERTY, securityManager);

        DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();
        docBuilder.setEntityResolver(new CarbonEntityResolver());
        Document document = docBuilder.parse(new ByteArrayInputStream(authReqStr.trim().getBytes()));
        Element element = document.getDocumentElement();
        UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
        Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);
        response = unmarshaller.unmarshall(element);
        // Check for duplicate samlp:Response
        NodeList list = response.getDOM().getElementsByTagNameNS(SAMLConstants.SAML20P_NS, "Response");
        if (list.getLength() > 0) {
            log.error("Invalid schema for the SAML2 reponse");
            throw new SAML2SSOAuthenticatorException("Error occured while processing saml2 response");
        }
        return response;
    } catch (ParserConfigurationException e) {
        log.error("Error occured while processing saml2 response");
        throw new SAML2SSOAuthenticatorException("Error occured while processing saml2 response", e);
    } catch (SAXException e) {
        log.error("Error occured while processing saml2 response");
        throw new SAML2SSOAuthenticatorException("Error occured while processing saml2 response", e);
    } catch (IOException e) {
        log.error("Error occured while processing saml2 response");
        throw new SAML2SSOAuthenticatorException("Error occured while processing saml2 response", e);
    } catch (UnmarshallingException e) {
        log.error("Error occured while processing saml2 response");
        throw new SAML2SSOAuthenticatorException("Error occured while processing saml2 response", e);
    }

}

From source file:org.wso2.carbon.identity.core.util.IdentityUtil.java

/**
 * Constructing the SAML or XACML Objects from a String
 *
 * @param xmlString Decoded SAML or XACML String
 * @return SAML or XACML Object//from w ww.ja  v a2s .  c  o m
 * @throws org.wso2.carbon.identity.base.IdentityException
 */
public static XMLObject unmarshall(String xmlString) throws IdentityException {

    try {
        DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
        documentBuilderFactory.setNamespaceAware(true);

        documentBuilderFactory.setExpandEntityReferences(false);
        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        org.apache.xerces.util.SecurityManager securityManager = new SecurityManager();
        securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
        documentBuilderFactory.setAttribute(SECURITY_MANAGER_PROPERTY, securityManager);

        DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();
        docBuilder.setEntityResolver(new CarbonEntityResolver());
        Document document = docBuilder
                .parse(new ByteArrayInputStream(xmlString.trim().getBytes(Charsets.UTF_8)));
        Element element = document.getDocumentElement();
        UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
        Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);
        return unmarshaller.unmarshall(element);
    } catch (ParserConfigurationException | UnmarshallingException | SAXException | IOException e) {
        String message = "Error in constructing XML Object from the encoded String";
        throw new IdentityException(message, e);
    }
}

From source file:org.wso2.carbon.identity.entitlement.common.InMemoryPersistenceManager.java

/**
 * * This method provides a secured document builder which will secure XXE attacks.
 *
 * @return DocumentBuilder//from  w w  w .  ja  v a2  s .  c  om
 * @throws ParserConfigurationException
 */
private DocumentBuilder getSecuredDocumentBuilder() throws ParserConfigurationException {

    DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
    documentBuilderFactory.setNamespaceAware(true);
    documentBuilderFactory.setExpandEntityReferences(false);
    documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    SecurityManager securityManager = new SecurityManager();
    securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
    documentBuilderFactory.setAttribute(SECURITY_MANAGER_PROPERTY, securityManager);
    DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
    documentBuilder.setEntityResolver(new CarbonEntityResolver());
    return documentBuilder;
}

From source file:org.wso2.carbon.identity.entitlement.EntitlementUtil.java

/**
 * * This method provides a secured document builder which will secure XXE attacks.
 *
 * @param setIgnoreComments whether to set setIgnoringComments in DocumentBuilderFactory.
 * @return DocumentBuilder// w w w.ja  v a2  s .  co  m
 * @throws ParserConfigurationException
 */
private static DocumentBuilder getSecuredDocumentBuilder(boolean setIgnoreComments)
        throws ParserConfigurationException {

    DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
    documentBuilderFactory.setIgnoringComments(setIgnoreComments);
    documentBuilderFactory.setNamespaceAware(true);
    documentBuilderFactory.setExpandEntityReferences(false);
    documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    SecurityManager securityManager = new SecurityManager();
    securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
    documentBuilderFactory.setAttribute(SECURITY_MANAGER_PROPERTY, securityManager);
    DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
    documentBuilder.setEntityResolver(new CarbonEntityResolver());
    return documentBuilder;

}

From source file:org.wso2.carbon.identity.entitlement.pap.PAPPolicyReader.java

private PAPPolicyReader(PolicyFinder policyFinder) {

    this.policyFinder = policyFinder;
    // create the factory
    DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
    documentBuilderFactory.setIgnoringComments(true);
    documentBuilderFactory.setNamespaceAware(true);
    documentBuilderFactory.setExpandEntityReferences(false);
    SecurityManager securityManager = new SecurityManager();
    securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
    documentBuilderFactory.setAttribute(SECURITY_MANAGER_PROPERTY, securityManager);

    // now use the factory to create the document builder
    try {// w  ww  .j  ava 2 s. c o m
        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        builder = documentBuilderFactory.newDocumentBuilder();
        builder.setEntityResolver(new CarbonEntityResolver());
        builder.setErrorHandler(this);
    } catch (ParserConfigurationException pce) {
        throw new IllegalArgumentException("Filed to setup repository: ");
    }
}

From source file:org.wso2.carbon.identity.entitlement.policy.PolicyRequestBuilder.java

/**
 * creates DOM representation of the XACML request
 *
 * @param request XACML request as a String object
 * @return XACML request as a DOM element
 * @throws EntitlementException throws, if fails
 *//*from w w  w.j  av a2  s  .com*/
public Element getXacmlRequest(String request) throws EntitlementException {

    ByteArrayInputStream inputStream;
    DocumentBuilderFactory documentBuilderFactory;
    Document doc;

    inputStream = new ByteArrayInputStream(request.getBytes());
    documentBuilderFactory = DocumentBuilderFactory.newInstance();
    documentBuilderFactory.setNamespaceAware(true);
    documentBuilderFactory.setExpandEntityReferences(false);

    SecurityManager securityManager = new SecurityManager();
    securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
    documentBuilderFactory.setAttribute(SECURITY_MANAGER_PROPERTY, securityManager);
    DocumentBuilder documentBuilder;
    try {
        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        documentBuilder = documentBuilderFactory.newDocumentBuilder();
        documentBuilder.setEntityResolver(new CarbonEntityResolver());
        doc = documentBuilder.parse(inputStream);
    } catch (SAXException e) {
        throw new EntitlementException("Error while creating DOM from XACML request");
    } catch (IOException e) {
        throw new EntitlementException("Error while creating DOM from XACML request");
    } catch (ParserConfigurationException e) {
        throw new EntitlementException("Error while creating DOM from XACML request");
    } finally {
        try {
            inputStream.close();
        } catch (IOException e) {
            log.error("Error in closing input stream of XACML request");
        }
    }
    return doc.getDocumentElement();
}