Class XMLInputFactoryUtil


  • public final class XMLInputFactoryUtil
    extends java.lang.Object
    Factory provides XMLInputFactory with secure defaults set. Properties not supported generate a warning, but the factory process creation will continue and return a result. Settings based on recommendations of Sonarcloud RSPEC-2755 and OWASP XML External Entity Prevention Cheatsheet.

    • XMLInputFactory.SUPPORT_DTD is set to false.
    • XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES is set to false.
    Since:
    1.6.0.Final
    Author:
    Boris Unckel
    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static javax.xml.stream.XMLInputFactory create()
      Factory generated with secure defaults.
      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
    • Method Detail

      • create

        @NotNull
        public static javax.xml.stream.XMLInputFactory create()
        Factory generated with secure defaults.
        Returns:
        an instance of the XMLInputFactory.