Skip to content

Commit 7ede053

Browse files
dotasekdotasek
committed
Move new documentbuilderfactory calls to XMLUtils
1 parent c030740 commit 7ede053

File tree

43 files changed

+153
-135
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+153
-135
lines changed

‎org.hl7.fhir.convertors/src/main/java/org/hl7/fhir/convertors/misc/CDAUtilities.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ public class CDAUtilities {
5151
private final Document doc;
5252

5353
public CDAUtilities(InputStream stream) throws Exception {
54-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
54+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
5555
factory.setNamespaceAware(true);
5656
DocumentBuilder builder = factory.newDocumentBuilder();
5757

‎org.hl7.fhir.convertors/src/main/java/org/hl7/fhir/convertors/misc/CKMImporter.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ private Document loadXml(String address) throws Exception {
130130
res.checkThrowException();
131131
InputStream xml = new ByteArrayInputStream(res.getContent());
132132

133-
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
133+
DocumentBuilderFactory dbf = XMLUtil.newXXEProtectedDocumentBuilderFactory();
134134
DocumentBuilder db = dbf.newDocumentBuilder();
135135
return db.parse(xml);
136136
}

‎org.hl7.fhir.convertors/src/main/java/org/hl7/fhir/convertors/misc/CountryCodesConverter.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,7 @@ private String lang3To2(String lang) {
357357
}
358358

359359
private Document load() throws ParserConfigurationException, SAXException, IOException {
360-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
360+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
361361
factory.setNamespaceAware(true);
362362
DocumentBuilder builder = factory.newDocumentBuilder();
363363

‎org.hl7.fhir.convertors/src/main/java/org/hl7/fhir/convertors/misc/DicomPackageBuilder.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ private JsonObject buildPackage() {
131131
}
132132

133133
private CodeSystem buildCodeSystem() throws ParserConfigurationException, FileNotFoundException, SAXException, IOException {
134-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
134+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
135135
factory.setNamespaceAware(true);
136136
DocumentBuilder builder = factory.newDocumentBuilder();
137137
Document doc = builder.parse(ManagedFileAccess.inStream(Utilities.path(source, "Resources", "Ontology", "DCM", "dcm.owl")));

‎org.hl7.fhir.convertors/src/main/java/org/hl7/fhir/convertors/misc/ICPC2Importer.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ public void setTargetFileNameVS(String targetFileName) {
120120
}
121121

122122
public void go() throws Exception {
123-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
123+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
124124
factory.setNamespaceAware(false);
125125
DocumentBuilder builder = factory.newDocumentBuilder();
126126
Document doc = builder.parse(ManagedFileAccess.inStream(sourceFileName));

‎org.hl7.fhir.convertors/src/main/java/org/hl7/fhir/convertors/misc/LoincToDEConvertor.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ private void log(String string) {
148148

149149
}
150150
private void loadLoinc() throws FileNotFoundException, SAXException, IOException, ParserConfigurationException {
151-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
151+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
152152
factory.setNamespaceAware(true);
153153
DocumentBuilder builder = factory.newDocumentBuilder();
154154

‎org.hl7.fhir.convertors/src/main/java/org/hl7/fhir/convertors/misc/adl/ADLImporter.java

+1-3
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
package org.hl7.fhir.convertors.misc.adl;
22

3-
import java.io.FileInputStream;
4-
import java.io.FileOutputStream;
53
import java.util.ArrayList;
64
import java.util.HashMap;
75
import java.util.List;
@@ -89,7 +87,7 @@ private static String getParam(String[] args, String name) {
8987

9088
private void execute() throws Exception {
9189
// load config
92-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
90+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
9391
factory.setNamespaceAware(true);
9492
DocumentBuilder builder = factory.newDocumentBuilder();
9593
adlConfig = builder.parse(ManagedFileAccess.inStream(config)).getDocumentElement();

‎org.hl7.fhir.convertors/src/main/java/org/hl7/fhir/convertors/misc/iso21090/ISO21090Importer.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -317,7 +317,7 @@ private String getDoco(Element en) {
317317
}
318318

319319
private void load() throws ParserConfigurationException, SAXException, IOException {
320-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
320+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
321321
factory.setNamespaceAware(false);
322322
DocumentBuilder builder = factory.newDocumentBuilder();
323323
Document doc = builder.parse(ManagedFileAccess.inStream("C:\\work\\projects\\org.hl7.v3.dt\\iso\\iso-21090-datatypes.xsd"));

‎org.hl7.fhir.dstu2/src/main/java/org/hl7/fhir/dstu2/terminologies/LoincToDEConvertor.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ private void log(String string) {
162162
}
163163

164164
private void loadLoinc() throws FileNotFoundException, SAXException, IOException, ParserConfigurationException {
165-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
165+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
166166
factory.setNamespaceAware(true);
167167
DocumentBuilder builder = factory.newDocumentBuilder();
168168

‎org.hl7.fhir.dstu2/src/main/java/org/hl7/fhir/dstu2/utils/DigitalSignatures.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
6060
import javax.xml.parsers.ParserConfigurationException;
6161

6262
import org.hl7.fhir.exceptions.FHIRException;
63+
import org.hl7.fhir.utilities.xml.XMLUtil;
6364
import org.hl7.fhir.utilities.xml.XmlGenerator;
6465
import org.w3c.dom.Document;
6566
import org.xml.sax.SAXException;
@@ -73,7 +74,7 @@ public static void main(String[] args)
7374
//
7475
byte[] inputXml = "<Envelope xmlns=\"urn:envelope\">\r\n</Envelope>\r\n".getBytes();
7576
// load the document that's going to be signed
76-
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
77+
DocumentBuilderFactory dbf = XMLUtil.newXXEProtectedDocumentBuilderFactory();
7778
dbf.setNamespaceAware(true);
7879
DocumentBuilder builder = dbf.newDocumentBuilder();
7980
Document doc = builder.parse(new ByteArrayInputStream(inputXml));

‎org.hl7.fhir.dstu2/src/main/java/org/hl7/fhir/dstu2/utils/Translations.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ public void setLang(String lang) {
7070
*/
7171
public void load(String filename)
7272
throws FileNotFoundException, SAXException, IOException, ParserConfigurationException {
73-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
73+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
7474
DocumentBuilder builder = factory.newDocumentBuilder();
7575
loadMessages(builder.parse(new CSFileInputStream(filename)));
7676
}

‎org.hl7.fhir.dstu2/src/test/java/org/hl7/fhir/dstu2/test/TestingUtilities.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
import org.hl7.fhir.utilities.Utilities;
1818
import org.hl7.fhir.utilities.filesystem.CSFile;
1919
import org.hl7.fhir.utilities.filesystem.ManagedFileAccess;
20+
import org.hl7.fhir.utilities.xml.XMLUtil;
2021
import org.w3c.dom.Document;
2122
import org.w3c.dom.Element;
2223
import org.w3c.dom.NamedNodeMap;
@@ -145,7 +146,7 @@ private static Node skipBlankText(Node node) {
145146
}
146147

147148
private static Document loadXml(String fn) throws Exception {
148-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
149+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
149150
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
150151
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
151152
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

‎org.hl7.fhir.dstu2016may/src/main/java/org/hl7/fhir/dstu2016may/metamodel/XmlParser.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ public XmlParser(IWorkerContext context) {
7878
public Element parse(InputStream stream) throws Exception {
7979
Document doc = null;
8080
try {
81-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
81+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
8282
// xxe protection
8383
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
8484
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);

‎org.hl7.fhir.dstu2016may/src/main/java/org/hl7/fhir/dstu2016may/terminologies/ICPC2Importer.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ public void setTargetFileNameVS(String targetFileName) {
116116
}
117117

118118
public void go() throws Exception {
119-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
119+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
120120
factory.setNamespaceAware(false);
121121
DocumentBuilder builder = factory.newDocumentBuilder();
122122
Document doc = builder.parse(ManagedFileAccess.inStream(sourceFileName));

‎org.hl7.fhir.dstu2016may/src/main/java/org/hl7/fhir/dstu2016may/terminologies/LoincToDEConvertor.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ private void log(String string) {
162162
}
163163

164164
private void loadLoinc() throws FileNotFoundException, SAXException, IOException, ParserConfigurationException {
165-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
165+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
166166
factory.setNamespaceAware(true);
167167
DocumentBuilder builder = factory.newDocumentBuilder();
168168

‎org.hl7.fhir.dstu2016may/src/main/java/org/hl7/fhir/dstu2016may/utils/DigitalSignatures.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
6060
import javax.xml.parsers.ParserConfigurationException;
6161

6262
import org.hl7.fhir.exceptions.FHIRException;
63+
import org.hl7.fhir.utilities.xml.XMLUtil;
6364
import org.hl7.fhir.utilities.xml.XmlGenerator;
6465
import org.w3c.dom.Document;
6566
import org.xml.sax.SAXException;
@@ -73,7 +74,7 @@ public static void main(String[] args) throws SAXException, IOException, ParserC
7374
//
7475
byte[] inputXml = "<Envelope xmlns=\"urn:envelope\">\r\n</Envelope>\r\n".getBytes();
7576
// load the document that's going to be signed
76-
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
77+
DocumentBuilderFactory dbf = XMLUtil.newXXEProtectedDocumentBuilderFactory();
7778
dbf.setNamespaceAware(true);
7879
DocumentBuilder builder = dbf.newDocumentBuilder();
7980
Document doc = builder.parse(new ByteArrayInputStream(inputXml));

‎org.hl7.fhir.dstu2016may/src/main/java/org/hl7/fhir/dstu2016may/utils/Translations.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ public void setLang(String lang) {
7070
*/
7171
public void load(String filename)
7272
throws FileNotFoundException, SAXException, IOException, ParserConfigurationException {
73-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
73+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
7474
DocumentBuilder builder = factory.newDocumentBuilder();
7575
loadMessages(builder.parse(new CSFileInputStream(filename)));
7676
}

‎org.hl7.fhir.dstu2016may/src/test/java/org/hl7/fhir/dstu2016may/test/TestingUtilities.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
import org.hl7.fhir.utilities.Utilities;
1818
import org.hl7.fhir.utilities.filesystem.CSFile;
1919
import org.hl7.fhir.utilities.filesystem.ManagedFileAccess;
20+
import org.hl7.fhir.utilities.xml.XMLUtil;
2021
import org.w3c.dom.Document;
2122
import org.w3c.dom.Element;
2223
import org.w3c.dom.NamedNodeMap;
@@ -145,7 +146,7 @@ private static Node skipBlankText(Node node) {
145146
}
146147

147148
private static Document loadXml(String fn) throws Exception {
148-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
149+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
149150
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
150151
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
151152
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

‎org.hl7.fhir.dstu3/src/main/java/org/hl7/fhir/dstu3/elementmodel/XmlParser.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ public void setAllowXsiLocation(boolean allowXsiLocation) {
9797
public Element parse(InputStream stream) throws FHIRFormatError, DefinitionException, FHIRException, IOException {
9898
Document doc = null;
9999
try {
100-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
100+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
101101
// xxe protection
102102
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
103103
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);

‎org.hl7.fhir.dstu3/src/main/java/org/hl7/fhir/dstu3/terminologies/LoincToDEConvertor.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ private void log(String string) {
154154

155155
}
156156
private void loadLoinc() throws FileNotFoundException, SAXException, IOException, ParserConfigurationException {
157-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
157+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
158158
factory.setNamespaceAware(true);
159159
DocumentBuilder builder = factory.newDocumentBuilder();
160160

‎org.hl7.fhir.dstu3/src/main/java/org/hl7/fhir/dstu3/utils/DigitalSignatures.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
6262
import javax.xml.parsers.ParserConfigurationException;
6363

6464
import org.hl7.fhir.exceptions.FHIRException;
65+
import org.hl7.fhir.utilities.xml.XMLUtil;
6566
import org.hl7.fhir.utilities.xml.XmlGenerator;
6667
import org.w3c.dom.Document;
6768
import org.xml.sax.SAXException;
@@ -74,7 +75,7 @@ public static void main(String[] args) throws SAXException, IOException, ParserC
7475
//
7576
byte[] inputXml = "<Envelope xmlns=\"urn:envelope\">\r\n</Envelope>\r\n".getBytes();
7677
// load the document that's going to be signed
77-
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
78+
DocumentBuilderFactory dbf = XMLUtil.newXXEProtectedDocumentBuilderFactory();
7879
dbf.setNamespaceAware(true);
7980
DocumentBuilder builder = dbf.newDocumentBuilder();
8081
Document doc = builder.parse(new ByteArrayInputStream(inputXml));

‎org.hl7.fhir.dstu3/src/main/java/org/hl7/fhir/dstu3/utils/Translations.java

+29-29
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,33 @@
11
package org.hl7.fhir.dstu3.utils;
22

3-
/*
4-
Copyright (c) 2011+, HL7, Inc.
5-
All rights reserved.
6-
7-
Redistribution and use in source and binary forms, with or without modification,
8-
are permitted provided that the following conditions are met:
9-
10-
* Redistributions of source code must retain the above copyright notice, this
11-
list of conditions and the following disclaimer.
12-
* Redistributions in binary form must reproduce the above copyright notice,
13-
this list of conditions and the following disclaimer in the documentation
14-
and/or other materials provided with the distribution.
15-
* Neither the name of HL7 nor the names of its contributors may be used to
16-
endorse or promote products derived from this software without specific
17-
prior written permission.
18-
19-
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
20-
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
21-
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22-
IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
23-
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24-
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
25-
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
26-
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27-
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28-
POSSIBILITY OF SUCH DAMAGE.
29-
30-
*/
3+
/*
4+
Copyright (c) 2011+, HL7, Inc.
5+
All rights reserved.
6+
7+
Redistribution and use in source and binary forms, with or without modification,
8+
are permitted provided that the following conditions are met:
9+
10+
* Redistributions of source code must retain the above copyright notice, this
11+
list of conditions and the following disclaimer.
12+
* Redistributions in binary form must reproduce the above copyright notice,
13+
this list of conditions and the following disclaimer in the documentation
14+
and/or other materials provided with the distribution.
15+
* Neither the name of HL7 nor the names of its contributors may be used to
16+
endorse or promote products derived from this software without specific
17+
prior written permission.
18+
19+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
20+
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
21+
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22+
IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
23+
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24+
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
25+
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
26+
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27+
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28+
POSSIBILITY OF SUCH DAMAGE.
29+
30+
*/
3131

3232

3333

@@ -71,7 +71,7 @@ public void setLang(String lang) {
7171
* @throws Exception
7272
*/
7373
public void load(String filename) throws FileNotFoundException, SAXException, IOException, ParserConfigurationException {
74-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
74+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
7575
DocumentBuilder builder = factory.newDocumentBuilder();
7676
loadMessages(builder.parse(new CSFileInputStream(filename)));
7777
}

‎org.hl7.fhir.dstu3/src/test/java/org/hl7/fhir/dstu3/test/support/TestingUtilities.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import org.hl7.fhir.utilities.filesystem.CSFile;
2121
import org.hl7.fhir.utilities.filesystem.ManagedFileAccess;
2222
import org.hl7.fhir.utilities.tests.BaseTestingUtilities;
23+
import org.hl7.fhir.utilities.xml.XMLUtil;
2324
import org.w3c.dom.Document;
2425
import org.w3c.dom.Element;
2526
import org.w3c.dom.NamedNodeMap;
@@ -176,7 +177,7 @@ private static Document loadXml(String fn) throws Exception {
176177
}
177178

178179
private static Document loadXml(InputStream fn) throws Exception {
179-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
180+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
180181
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
181182
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
182183
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

‎org.hl7.fhir.r4/src/main/java/org/hl7/fhir/r4/elementmodel/XmlParser.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ public void setAllowXsiLocation(boolean allowXsiLocation) {
9696
public Element parse(InputStream stream) throws FHIRFormatError, DefinitionException, FHIRException, IOException {
9797
Document doc = null;
9898
try {
99-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
99+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
100100
// xxe protection
101101
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
102102
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);

‎org.hl7.fhir.r4/src/main/java/org/hl7/fhir/r4/terminologies/LoincToDEConvertor.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ private void log(String string) {
156156
}
157157

158158
private void loadLoinc() throws FileNotFoundException, SAXException, IOException, ParserConfigurationException {
159-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
159+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
160160
factory.setNamespaceAware(true);
161161
DocumentBuilder builder = factory.newDocumentBuilder();
162162

‎org.hl7.fhir.r4/src/main/java/org/hl7/fhir/r4/test/utils/TestingUtilities.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
5959
import org.hl7.fhir.utilities.tests.BaseTestingUtilities;
6060
import org.hl7.fhir.utilities.tests.ResourceLoaderTests;
6161
import org.hl7.fhir.utilities.tests.TestConfig;
62+
import org.hl7.fhir.utilities.xml.XMLUtil;
6263
import org.w3c.dom.Document;
6364
import org.w3c.dom.Element;
6465
import org.w3c.dom.NamedNodeMap;
@@ -256,7 +257,7 @@ private static Document loadXml(String fn) throws Exception {
256257
}
257258

258259
private static Document loadXml(InputStream fn) throws Exception {
259-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
260+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
260261
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
261262
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
262263
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

‎org.hl7.fhir.r4/src/main/java/org/hl7/fhir/r4/utils/DigitalSignatures.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
6060

6161
import org.hl7.fhir.utilities.Utilities;
6262
import org.hl7.fhir.utilities.filesystem.ManagedFileAccess;
63+
import org.hl7.fhir.utilities.xml.XMLUtil;
6364
import org.hl7.fhir.utilities.xml.XmlGenerator;
6465
import org.w3c.dom.Document;
6566

@@ -88,7 +89,7 @@ public static void main(String[] args) throws Exception {
8889
//
8990
byte[] inputXml = "<Envelope xmlns=\"urn:envelope\">\r\n</Envelope>\r\n".getBytes();
9091
// load the document that's going to be signed
91-
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
92+
DocumentBuilderFactory dbf = XMLUtil.newXXEProtectedDocumentBuilderFactory();
9293
dbf.setNamespaceAware(true);
9394
DocumentBuilder builder = dbf.newDocumentBuilder();
9495
Document doc = builder.parse(new ByteArrayInputStream(inputXml));

‎org.hl7.fhir.r4/src/main/java/org/hl7/fhir/r4/utils/Translations.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ public void setLang(String lang) {
7070
*/
7171
public void load(String filename)
7272
throws FileNotFoundException, SAXException, IOException, ParserConfigurationException {
73-
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
73+
DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory();
7474
DocumentBuilder builder = factory.newDocumentBuilder();
7575
loadMessages(builder.parse(new CSFileInputStream(filename)));
7676
}

0 commit comments

Comments
 (0)