title: XML validation using XSD in java
body: <p>I have the following class:</p>
  
  <pre><code>package com.somedir.someotherdir;
  
  import java.util.logging.Level;
  import java.util.logging.Logger;
  
  import javax.xml.XMLConstants;
  import javax.xml.transform.stream.StreamSource;
  import javax.xml.validation.Schema;
  import javax.xml.validation.SchemaFactory;
  import javax.xml.validation.Validator;
  
  public class SchemaValidator
  {
   private static Logger _logger = Logger.getLogger(SchemaValidator.class.getName());
  
   /**
    * @param file - the relative path to and the name of the XML file to be validated
    * @return true if validation succeeded, false otherwise
    */
   public final static boolean validateXML(String file)
   {
    try
    {
     SchemaFactory factory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
     Schema schema = factory.newSchema();
     Validator validator = schema.newValidator();
     validator.validate(new StreamSource(file));
     return true;
    }
    catch (Exception e)
    {
     _logger.log(Level.WARNING, "SchemaValidator: failed validating " + file + ". Reason: " + e.getMessage(), e);
     return false;
    }
   }
  }
  </code></pre>
  
  <p>I would like to know if I should use <code>schema.newValidator("dir/to/schema.xsd")</code> after all or is the current version alright? I read that there's some DoS vulnerability, maybe someone could provide more info on that? Also, does the path have to be absolute or relative?<br>
  Most of the XMLs to be validated each have their own XSD, so I'd like to read the schema that is mentioned in the XML itself (<code>xs:noNamespaceSchemaLocation="schemaname.xsd"</code>).<br>
  The validation is done only during startup or manual reload (server software).  </p>