I am using javax SchemaFactory to parse an XML file. I get a SonarLint warning "Disable access to external entities in XML parsing.". The warning goes away when adding two properties "ACCESS_EXTERNAL_DTD" and "ACCESS_EXTERNAL_SCHEMA". However, when parsing something I get the runtime error "Feature 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.". Why is it not recognized and how to fix this? My code:
import javax.xml.XMLConstants;
import javax.xml.validation.Schema;
import javax.xml.validation.SchemaFactory;
public class MinimalExample {
public static void main(String[] args) {
SchemaFactory factory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
}
}
I don't understand why those properties are not recognized and don't know what else to try.
SchemaFactorythat is instantiated? My guess would be that it's a shim designed to wrap some underlying schema factory, and people who write such shims often overlook the need to recognize these standard properties.javax.xml.validation.Schemais an interface, not an implementation. The whole point of thenewInstance()factory mechanism is that you pick up whatever implementation is available at run-time, which might not be Oracle's implementation. Quite honestly, SonarQube analysis is a waste of space: it's picking up that you're not setting some pretty weak security properties, but it's failing to pick up that you might be loading a fake schema processor from anywhere.