@Test public void testDTDInResults() throws Exception { URL resultsUrl = XMLConfigParserTest.class.getResource("/malicious_results_with_dtd.xml"); assertNotNull(resultsUrl); File resultsFile = new File(resultsUrl.getFile()); XMLResultHandler handler = new XMLResultHandler(); try { handler.readFromResultFile(resultsFile); fail("Expected to see an exception parsing the results with a DTD"); } catch (UnmarshalException e) { LOGGER.debug("Caught expected exception", e); Throwable cause = e.getLinkedException(); assertTrue("Cause was a " + cause.getClass(), cause instanceof XMLStreamException); } }
List<Result> readFromResultFile(File resultsFile) throws Exception { XMLInputFactory xif = XMLInputFactory.newInstance(); xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xif.setProperty(XMLInputFactory.SUPPORT_DTD, false); JAXBContext jaxbContext = JAXBContext.newInstance(DataModelResult.class); Unmarshaller jaxbUnmarshaller = jaxbContext.createUnmarshaller(); @SuppressWarnings("rawtypes") List<ResultValue> resultValue = new ArrayList<>(); XMLStreamReader xmlReader = xif.createXMLStreamReader(new StreamSource(resultsFile)); resultValue.add(new ResultValue<>(jaxbUnmarshaller.unmarshal(xmlReader))); List<Result> results = new ArrayList<>(); results.add(new Result(ResultFileDetails.XML, null, resultValue)); return results; }
XMLResultHandler extends DefaultResultHandler { List<Result> readFromResultFile(File resultsFile) throws Exception { XMLInputFactory xif = XMLInputFactory.newInstance(); xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xif.setProperty(XMLInputFactory.SUPPORT_DTD, false); JAXBContext jaxbContext = JAXBContext.newInstance(DataModelResult.class); Unmarshaller jaxbUnmarshaller = jaxbContext.createUnmarshaller(); @SuppressWarnings("rawtypes") List<ResultValue> resultValue = new ArrayList<>(); XMLStreamReader xmlReader = xif.createXMLStreamReader(new StreamSource(resultsFile)); resultValue.add(new ResultValue<>(jaxbUnmarshaller.unmarshal(xmlReader))); List<Result> results = new ArrayList<>(); results.add(new Result(ResultFileDetails.XML, null, resultValue)); return results; } }
XMLResultHandler extends DefaultResultHandler { List<Result> readFromResultFile(File resultsFile) throws Exception { XMLInputFactory xif = XMLInputFactory.newInstance(); xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xif.setProperty(XMLInputFactory.SUPPORT_DTD, false); JAXBContext jaxbContext = JAXBContext.newInstance(DataModelResult.class); Unmarshaller jaxbUnmarshaller = jaxbContext.createUnmarshaller(); @SuppressWarnings("rawtypes") List<ResultValue> resultValue = new ArrayList<>(); XMLStreamReader xmlReader = xif.createXMLStreamReader(new StreamSource(resultsFile)); resultValue.add(new ResultValue<>(jaxbUnmarshaller.unmarshal(xmlReader))); List<Result> results = new ArrayList<>(); results.add(new Result(ResultFileDetails.XML, null, resultValue)); return results; } XMLResultHandler(); }
XMLResultHandler extends DefaultResultHandler { List<Result> readFromResultFile(File resultsFile) throws Exception { XMLInputFactory xif = XMLInputFactory.newInstance(); xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xif.setProperty(XMLInputFactory.SUPPORT_DTD, false); JAXBContext jaxbContext = JAXBContext.newInstance(DataModelResult.class); Unmarshaller jaxbUnmarshaller = jaxbContext.createUnmarshaller(); @SuppressWarnings("rawtypes") List<ResultValue> resultValue = new ArrayList<>(); XMLStreamReader xmlReader = xif.createXMLStreamReader(new StreamSource(resultsFile)); resultValue.add(new ResultValue<>(jaxbUnmarshaller.unmarshal(xmlReader))); List<Result> results = new ArrayList<>(); results.add(new Result(ResultFileDetails.XML, null, resultValue)); return results; } XMLResultHandler(); @Override synchronized void write(Result result); @Override synchronized void flush(); @Override synchronized void close(); @Override synchronized List<Result> read(); @Override boolean isClosed(); @Override void setResultFileDetails(ResultFileDetails details); }
XMLResultHandler extends DefaultResultHandler { List<Result> readFromResultFile(File resultsFile) throws Exception { XMLInputFactory xif = XMLInputFactory.newInstance(); xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xif.setProperty(XMLInputFactory.SUPPORT_DTD, false); JAXBContext jaxbContext = JAXBContext.newInstance(DataModelResult.class); Unmarshaller jaxbUnmarshaller = jaxbContext.createUnmarshaller(); @SuppressWarnings("rawtypes") List<ResultValue> resultValue = new ArrayList<>(); XMLStreamReader xmlReader = xif.createXMLStreamReader(new StreamSource(resultsFile)); resultValue.add(new ResultValue<>(jaxbUnmarshaller.unmarshal(xmlReader))); List<Result> results = new ArrayList<>(); results.add(new Result(ResultFileDetails.XML, null, resultValue)); return results; } XMLResultHandler(); @Override synchronized void write(Result result); @Override synchronized void flush(); @Override synchronized void close(); @Override synchronized List<Result> read(); @Override boolean isClosed(); @Override void setResultFileDetails(ResultFileDetails details);  }