Module io.sf.carte.css4j
Package io.sf.carte.doc.xml.dtd

Class DefaultEntityResolver

java.lang.Object
io.sf.carte.doc.xml.dtd.DefaultEntityResolver
All Implemented Interfaces:
EntityResolver, EntityResolver2
public class DefaultEntityResolver extends Object implements EntityResolver2
Implements EntityResolver2.

Has common W3C DTDs/entities built-in and loads others via the supplied SYSTEM URL, provided that certain conditions are met:

  • URL protocol is http/https.
  • Either the mime type is valid for a DTD or entity, or the filename ends with .dtd, .ent or .mod.
  • The whitelist is either disabled (no host added to it) or contains the host from the URL.

If the whitelist was enabled (e.g. default constructor), any attempt to download data from a remote URL not present in the whitelist is going to produce an exception. You can use that to determine whether your documents are referencing a DTD resource that is not bundled with this resolver.

If the constructor with a false argument was used, the whitelist can still be enabled by adding a hostname via addHostToWhiteList(String).

Although this resolver should protect you from most information leaks (see SSRF attacks) and also from jar: decompression bombs, DoS attacks based on entity expansion/recursion like the 'billion laughs attack' may still be possible and should be prevented at the XML parser. Be sure to use a properly configured, recent version of your parser.

  • Constructor Details

    • DefaultEntityResolver

      public DefaultEntityResolver()
      Construct a resolver with the whitelist enabled.

    • DefaultEntityResolver

      public DefaultEntityResolver(boolean enableWhitelist)
      Construct a resolver with the whitelist enabled or disabled according to enableWhitelist.
      Parameters:
      enableWhitelist - can be false to allow connecting to any host to retrieve DTDs or entities, or true to enable the (empty) whitelist so no network connections are to be allowed until a host is added to it.

  • Method Details