public enum XmlParserFeature extends java.lang.Enum
Registered SAX and Xerces parser feature identifiers used to harden XML parsing.
These values are opaque identifiers, not addresses. Nothing is ever fetched
from them. A parser matches them by exact string comparison against the prefixes it registers
internally, http://xml.org/sax/features/ and http://apache.org/xml/features/.
Do not rewrite the http scheme to https. No parser
recognizes the https spelling; setFeature answers it with
SAXNotRecognizedException. Because callers wrap setFeature in a catch that
tolerates parsers lacking a feature, an unrecognised name is swallowed and the hardening is
silently disabled rather than failing loudly. A blanket "prefer https" sweep over the codebase
therefore turns XML hardening off without leaving a trace, which is exactly what happened
before these values were collected here.
Consumers must assert parser behaviour rather than reading these names back, so that the guarding tests hold no copy of the identifiers and cannot be rewritten by the same sweep.
| Enum constant | Description |
|---|---|
DISALLOW_DOCTYPE_DECL |
Rejects any document carrying a DOCTYPE declaration. |
EXTERNAL_GENERAL_ENTITIES |
Blocks resolution of external general entities, the primary XXE vector. |
EXTERNAL_PARAMETER_ENTITIES |
Blocks resolution of external parameter entities. |
LOAD_DTD_GRAMMAR |
Stops the parser building a grammar from a DTD. |
LOAD_EXTERNAL_DTD |
Skips external DTD subsets instead of retrieving them. |
| Type Params | Return Type | Name and description |
|---|---|---|
|
public java.lang.String |
getFeatureName()
|
|
public java.lang.String |
toString() |
| Methods inherited from class | Name |
|---|---|
class java.lang.Enum |
java.lang.Enum#compareTo(java.lang.Enum), java.lang.Enum#compareTo(java.lang.Object), java.lang.Enum#describeConstable(), java.lang.Enum#equals(java.lang.Object), java.lang.Enum#getClass(), java.lang.Enum#getDeclaringClass(), java.lang.Enum#hashCode(), java.lang.Enum#name(), java.lang.Enum#notify(), java.lang.Enum#notifyAll(), java.lang.Enum#ordinal(), java.lang.Enum#toString(), java.lang.Enum#valueOf(java.lang.Class, java.lang.String), java.lang.Enum#wait(), java.lang.Enum#wait(long), java.lang.Enum#wait(long, int) |
Rejects any document carrying a DOCTYPE declaration.
Enabling this is stricter than blocking external entities: it refuses documents whose
DOCTYPE is entirely internal and harmless. It suits untrusted input such as HTTP request
bodies. Descriptors read from the classpath — JSP tag library definitions and
web.xml — routinely carry a DOCTYPE, so their readers need a parser that leaves this
disabled while keeping the entity and DTD features below switched off.
Blocks resolution of external general entities, the primary XXE vector.
Blocks resolution of external parameter entities.
Stops the parser building a grammar from a DTD.
Skips external DTD subsets instead of retrieving them.
This differs from the JAXP XMLConstants.ACCESS_EXTERNAL_DTD property, which
raises an error when a document references an external DTD. Skipping is what allows a
descriptor that names a DTD, such as a JSP 1.2 tag library, to parse without retrieving it.