import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * Create DocumentBuilderFactory with the XXE and XEE prevention measurements.
 *
 * @return DocumentBuilderFactory instance
 */
public static DocumentBuilderFactory getSecuredDocumentBuilderFactory() {

    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);
    dbf.setXIncludeAware(false);
    dbf.setExpandEntityReferences(false);
    try {
        dbf.setFeature(Constants.SAX_FEATURE_PREFIX + Constants.EXTERNAL_GENERAL_ENTITIES_FEATURE, false);
        dbf.setFeature(Constants.SAX_FEATURE_PREFIX + Constants.EXTERNAL_PARAMETER_ENTITIES_FEATURE, false);
        dbf.setFeature(Constants.XERCES_FEATURE_PREFIX + Constants.LOAD_EXTERNAL_DTD_FEATURE, false);
        dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

    } catch (ParserConfigurationException e) {
        log.error("Failed to load XML Processor Feature " + Constants.EXTERNAL_GENERAL_ENTITIES_FEATURE + " or " +
                Constants.EXTERNAL_PARAMETER_ENTITIES_FEATURE + " or " + Constants.LOAD_EXTERNAL_DTD_FEATURE +
                " or secure-processing.");
    }

    SecurityManager securityManager = new SecurityManager();
    securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
    dbf.setAttribute(Constants.XERCES_PROPERTY_PREFIX + Constants.SECURITY_MANAGER_PROPERTY, securityManager);

    return dbf;

}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * Get document builder factory instance.
 *
 * @return documentBuilderFactory
 */
private DocumentBuilderFactory getSecuredDocumentBuilder() {
    DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
    documentBuilderFactory.setNamespaceAware(true);
    documentBuilderFactory.setXIncludeAware(false);
    documentBuilderFactory.setExpandEntityReferences(false);
    try {
        documentBuilderFactory.setFeature(Constants.SAX_FEATURE_PREFIX +
                Constants.EXTERNAL_GENERAL_ENTITIES_FEATURE, false);
        documentBuilderFactory.setFeature(Constants.SAX_FEATURE_PREFIX +
                Constants.EXTERNAL_PARAMETER_ENTITIES_FEATURE, false);
        documentBuilderFactory.setFeature(Constants.XERCES_FEATURE_PREFIX +
                Constants.LOAD_EXTERNAL_DTD_FEATURE, false);
        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    } catch (ParserConfigurationException e) {
        log.error("Failed to load XML Processor Feature " + Constants.EXTERNAL_GENERAL_ENTITIES_FEATURE + " or " +
                Constants.EXTERNAL_PARAMETER_ENTITIES_FEATURE + " or " + Constants.LOAD_EXTERNAL_DTD_FEATURE);
    }

    SecurityManager securityManager = new SecurityManager();
    securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
    documentBuilderFactory.setAttribute(Constants.XERCES_PROPERTY_PREFIX +
            Constants.SECURITY_MANAGER_PROPERTY, securityManager);
    return documentBuilderFactory;
}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
public XSParser(LSResourceResolver entityResolver, DOMErrorHandler errorHandler){
    System.setProperty(DOMImplementationRegistry.PROPERTY, DOMXSImplementationSourceImpl.class.getName());
    DOMImplementationRegistry registry;
    try{
        registry = DOMImplementationRegistry.newInstance();
    }catch(Exception ex){
        throw new ImpossibleException(ex);
    }
    XSImplementationImpl xsImpl = (XSImplementationImpl)registry.getDOMImplementation("XS-Loader");

    xsLoader = xsImpl.createXSLoader(null);
    DOMConfiguration config = xsLoader.getConfig();
    config.setParameter(Constants.DOM_VALIDATE, Boolean.TRUE);

    if(entityResolver!=null)
        config.setParameter(Constants.DOM_RESOURCE_RESOLVER, entityResolver);

    if(errorHandler!=null)
        config.setParameter(Constants.DOM_ERROR_HANDLER, errorHandler);
}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * This method notifies of the start of an entity. The DTD has the
 * pseudo-name of "[dtd]" parameter entity names start with '%'; and
 * general entity names are just the entity name.
 * <p>
 * <strong>Note:</strong> Since the document is an entity, the handler
 * will be notified of the start of the document entity by calling the
 * startEntity method with the entity name "[xml]" <em>before</em> calling
 * the startDocument method. When exposing entity boundaries through the
 * SAX API, the document entity is never reported, however.
 * <p>
 * <strong>Note:</strong> This method is not called for entity references
 * appearing as part of attribute values.
 *
 * @param name     The name of the entity.
 * @param identifier The resource identifier.
 * @param encoding The auto-detected IANA encoding name of the entity
 *                 stream. This value will be null in those situations
 *                 where the entity encoding is not auto-detected (e.g.
 *                 internal parameter entities).
 * @param augs     Additional information that may include infoset augmentations
 *
 * @throws XNIException Thrown by handler to signal an error.
 */
public void startGeneralEntity(String name, XMLResourceIdentifier identifier, 
                               String encoding, Augmentations augs)
    throws XNIException {
    
    try {
        // Only report startEntity if this entity was actually read.
        if (augs != null && Boolean.TRUE.equals(augs.getItem(Constants.ENTITY_SKIPPED))) {
            // report skipped entity to content handler
            if (fContentHandler != null) {
                fContentHandler.skippedEntity(name);
            }
        }
        else {
            // SAX2 extension
            if (fLexicalHandler != null) {
                fLexicalHandler.startEntity(name);
            }
        }
    }
    catch (SAXException e) {
        throw new XNIException(e);
    }

}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * This method notifies of the start of parameter entity. The DTD has the
 * pseudo-name of "[dtd]" parameter entity names start with '%'; and
 * general entity names are just the entity name.
 * <p>
 * <strong>Note:</strong> Since the document is an entity, the handler
 * will be notified of the start of the document entity by calling the
 * startEntity method with the entity name "[xml]" <em>before</em> calling
 * the startDocument method. When exposing entity boundaries through the
 * SAX API, the document entity is never reported, however.
 * <p>
 * <strong>Note:</strong> This method is not called for entity references
 * appearing as part of attribute values.
 *
 * @param name     The name of the parameter entity.
 * @param identifier The resource identifier.
 * @param encoding The auto-detected IANA encoding name of the entity
 *                 stream. This value will be null in those situations
 *                 where the entity encoding is not auto-detected (e.g.
 *                 internal parameter entities).
 * @param augs Additional information that may include infoset
 *                      augmentations.
 *
 * @throws XNIException Thrown by handler to signal an error.
 */
public void startParameterEntity(String name, 
                                 XMLResourceIdentifier identifier,
                                 String encoding, Augmentations augs)
    throws XNIException {

    try {
        // Only report startEntity if this entity was actually read.
        if (augs != null && Boolean.TRUE.equals(augs.getItem(Constants.ENTITY_SKIPPED))) {
            // report skipped entity to content handler
            if (fContentHandler != null) {
                fContentHandler.skippedEntity(name);
            }
        }
        else {
            // SAX2 extension
            if (fLexicalHandler != null && fLexicalHandlerParameterEntities) {
                fLexicalHandler.startEntity(name);
            }
        }
    }
    catch (SAXException e) {
        throw new XNIException(e);
    }

}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * Create DocumentBuilderFactory with the XXE prevention measurements
 *
 * @return DocumentBuilderFactory instance
 */
public static DocumentBuilderFactory getSecuredDocumentBuilderFactory() {

    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);
    dbf.setXIncludeAware(false);
    dbf.setExpandEntityReferences(false);
    try {
        dbf.setFeature(Constants.SAX_FEATURE_PREFIX + Constants.EXTERNAL_GENERAL_ENTITIES_FEATURE, false);
        dbf.setFeature(Constants.SAX_FEATURE_PREFIX + Constants.EXTERNAL_PARAMETER_ENTITIES_FEATURE, false);
        dbf.setFeature(Constants.XERCES_FEATURE_PREFIX + Constants.LOAD_EXTERNAL_DTD_FEATURE, false);
        dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    } catch (ParserConfigurationException e) {
        logger.error(
                "Failed to load XML Processor Feature " + Constants.EXTERNAL_GENERAL_ENTITIES_FEATURE + " or " +
                        Constants.EXTERNAL_PARAMETER_ENTITIES_FEATURE + " or " + Constants.LOAD_EXTERNAL_DTD_FEATURE);
    }

    SecurityManager securityManager = new SecurityManager();
    securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
    dbf.setAttribute(Constants.XERCES_PROPERTY_PREFIX + Constants.SECURITY_MANAGER_PROPERTY, securityManager);

    return dbf;
}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * Create DocumentBuilderFactory with the XXE and XEE prevention measurements.
 *
 * @return DocumentBuilderFactory instance
 */
public static DocumentBuilderFactory getSecuredDocumentBuilder() {

    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);
    dbf.setXIncludeAware(false);
    dbf.setExpandEntityReferences(false);
    try {
        dbf.setFeature(Constants.SAX_FEATURE_PREFIX + Constants.EXTERNAL_GENERAL_ENTITIES_FEATURE, false);
        dbf.setFeature(Constants.SAX_FEATURE_PREFIX + Constants.EXTERNAL_PARAMETER_ENTITIES_FEATURE, false);
        dbf.setFeature(Constants.XERCES_FEATURE_PREFIX + Constants.LOAD_EXTERNAL_DTD_FEATURE, false);
        dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

    } catch (ParserConfigurationException e) {
        log.error("Failed to load XML Processor Feature " + Constants.EXTERNAL_GENERAL_ENTITIES_FEATURE + " or " +
                Constants.EXTERNAL_PARAMETER_ENTITIES_FEATURE + " or " + Constants.LOAD_EXTERNAL_DTD_FEATURE +
                " or secure-processing.");
    }

    SecurityManager securityManager = new SecurityManager();
    securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
    dbf.setAttribute(Constants.XERCES_PROPERTY_PREFIX + Constants.SECURITY_MANAGER_PROPERTY, securityManager);

    return dbf;

}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
private static DocumentBuilderFactory getSecuredDocumentBuilder() {
    final int ENTITY_EXPANSION_LIMIT = 0;
    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);
    dbf.setXIncludeAware(false);
    dbf.setExpandEntityReferences(false);

    try {
        dbf.setFeature(Constants.SAX_FEATURE_PREFIX + Constants.EXTERNAL_GENERAL_ENTITIES_FEATURE, false);
        dbf.setFeature(Constants.SAX_FEATURE_PREFIX + Constants.EXTERNAL_PARAMETER_ENTITIES_FEATURE, false);
        dbf.setFeature(Constants.XERCES_FEATURE_PREFIX + Constants.LOAD_EXTERNAL_DTD_FEATURE, false);
        dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    } catch (ParserConfigurationException e) {
        // Skip throwing the error as this exception doesn't break actual DocumentBuilderFactory creation
        log.error("Failed to load XML Processor Feature " + Constants.EXTERNAL_GENERAL_ENTITIES_FEATURE + " or "
                + Constants.EXTERNAL_PARAMETER_ENTITIES_FEATURE + " or " + Constants.LOAD_EXTERNAL_DTD_FEATURE, e);
    }

    SecurityManager securityManager = new SecurityManager();
    securityManager.setEntityExpansionLimit(ENTITY_EXPANSION_LIMIT);
    dbf.setAttribute(Constants.XERCES_PROPERTY_PREFIX + Constants.SECURITY_MANAGER_PROPERTY, securityManager);
    return dbf;
}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * Check a property. If the property is know and supported, this method
 * simply returns. Otherwise, the appropriate exception is thrown.
 *
 * @param propertyId The unique identifier (URI) of the property
 *                   being set.
 *
 * @throws XMLConfigurationException Thrown for configuration error.
 *                                   In general, components should
 *                                   only throw this exception if
 *                                   it is <strong>really</strong>
 *                                   a critical error.
 */
protected void checkProperty(String propertyId)
    throws XMLConfigurationException {

    //
    // Xerces Properties
    //

    if (propertyId.startsWith(Constants.XERCES_PROPERTY_PREFIX)) {
        final int suffixLength = propertyId.length() - Constants.XERCES_PROPERTY_PREFIX.length();

        if (suffixLength == Constants.DTD_SCANNER_PROPERTY.length() && 
            propertyId.endsWith(Constants.DTD_SCANNER_PROPERTY)) {
            return;
        }
    }

    //
    // Not recognized
    //

    super.checkProperty(propertyId);

}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * This method notifies of the start of a parameter entity. The parameter
 * entity name start with a '%' character.
 *
 * @param name     The name of the parameter entity.
 * @param identifier The resource identifier.
 * @param encoding The auto-detected IANA encoding name of the entity
 *                 stream. This value will be null in those situations
 *                 where the entity encoding is not auto-detected (e.g.
 *                 internal parameter entities).
 * @param augs Additional information that may include infoset
 *                      augmentations.
 *
 * @throws XNIException Thrown by handler to signal an error.
 */
public void startParameterEntity (String name,
XMLResourceIdentifier identifier,
String encoding,
Augmentations augs) throws XNIException {
    if (DEBUG_EVENTS) {
        System.out.println ("==>startParameterEntity: "+name);
        if (DEBUG_BASEURI) {
            System.out.println ("   expandedSystemId: "+identifier.getExpandedSystemId ());
            System.out.println ("   baseURI:"+ identifier.getBaseSystemId ());
        }
    }
    if (augs != null && fInternalSubset != null && 
        !fInDTDExternalSubset && 
        Boolean.TRUE.equals(augs.getItem(Constants.ENTITY_SKIPPED))) {
        fInternalSubset.append(name).append(";\n");
    }
    fBaseURIStack.push (identifier.getExpandedSystemId ());
}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * Check a feature. If feature is know and supported, this method simply
 * returns. Otherwise, the appropriate exception is thrown.
 *
 * @param featureId The unique identifier (URI) of the feature.
 *
 * @throws XMLConfigurationException Thrown for configuration error.
 *                                   In general, components should
 *                                   only throw this exception if
 *                                   it is <strong>really</strong>
 *                                   a critical error.
 */
protected void checkFeature(String featureId)
    throws XMLConfigurationException {

    //
    // Xerces Features
    //
    if (featureId.startsWith(Constants.XERCES_FEATURE_PREFIX)) {
        final int suffixLength = featureId.length() - Constants.XERCES_FEATURE_PREFIX.length();

        //
        // special performance feature: no one by component manager is allowed to set it
        //
        if (suffixLength == Constants.PARSER_SETTINGS.length() && 
            featureId.endsWith(Constants.PARSER_SETTINGS)) {
            short type = XMLConfigurationException.NOT_SUPPORTED;
            throw new XMLConfigurationException(type, featureId);
        }
    }

    super.checkFeature(featureId);

 }
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * Resets the parser state.
 *
 * @throws SAXException Thrown on initialization error.
 */
public void reset () {
    super.reset();
    
    // get state of namespace-declarations parameter.
    fNamespaceDeclarations = 
        fConfiguration.getFeature(Constants.DOM_NAMESPACE_DECLARATIONS);
            
    // DOM Filter
    if (fNullFilterInUse) {
        fDOMFilter = null;
        fNullFilterInUse = false;
    }
    if (fSkippedElemStack != null) {
        fSkippedElemStack.removeAllElements();
    }
    fRejectedElementDepth = 0;
    fFilterReject = false;
    fSchemaType = null;

}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
public void endElement(QName element, Augmentations augs)
        throws XNIException {
    final Node currentElement = fDOMValidatorHelper.getCurrentElement();
    // Write type information to this element
    if (augs != null && fDocumentImpl != null) {
        ElementPSVI elementPSVI = (ElementPSVI)augs.getItem(Constants.ELEMENT_PSVI);
        if (elementPSVI != null) {
            if (fStorePSVI) {
                ((PSVIElementNSImpl) currentElement).setPSVI(elementPSVI);
            }
            XSTypeDefinition type = elementPSVI.getMemberTypeDefinition();
            if (type == null) {
                type = elementPSVI.getTypeDefinition();
            }
            ((ElementNSImpl) currentElement).setType(type);
        }
    }
}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
public void endElement(QName element, Augmentations augs)
        throws XNIException {
    // write type information to this element
    if (augs != null && fDocumentImpl != null) {
        ElementPSVI elementPSVI = (ElementPSVI)augs.getItem(Constants.ELEMENT_PSVI);
        if (elementPSVI != null) {
            if (fStorePSVI) {
                ((PSVIElementNSImpl)fCurrentNode).setPSVI(elementPSVI);
            }
            XSTypeDefinition type = elementPSVI.getMemberTypeDefinition();
            if (type == null) {
                type = elementPSVI.getTypeDefinition();
            }
            ((ElementNSImpl)fCurrentNode).setType(type);
        }
    }
    
    // adjust current node reference
    if (fCurrentNode == fFragmentRoot) {
        fCurrentNode = null;
        fFragmentRoot = null;
        return;
    }
    fCurrentNode = fCurrentNode.getParentNode();
}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
public short getPrimitiveKind() {
    if (fVariety == VARIETY_ATOMIC && fValidationDV != DV_ANYSIMPLETYPE) {
        if (fValidationDV == DV_ID || fValidationDV == DV_IDREF || fValidationDV == DV_ENTITY) {
            return DV_STRING;
        }
        else if (fValidationDV == DV_INTEGER) {
            return DV_DECIMAL;
        }
        else if (Constants.SCHEMA_1_1_SUPPORT && (fValidationDV == DV_YEARMONTHDURATION || fValidationDV == DV_DAYTIMEDURATION)) {
            return DV_DURATION;
        }
        else {
            return fValidationDV;
        }
    }
    else {
        // REVISIT: error situation. runtime exception?
        return (short)0;
    }
}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
private short getPrimitiveDV(short validationDV){

        if (validationDV == DV_ID || validationDV == DV_IDREF || validationDV == DV_ENTITY){
            return DV_STRING;
        }
        else if (validationDV == DV_INTEGER) {
            return DV_DECIMAL;
        }
        else if (Constants.SCHEMA_1_1_SUPPORT && (validationDV == DV_YEARMONTHDURATION || validationDV == DV_DAYTIMEDURATION)) {
            return DV_DURATION;
        }
        else {
            return validationDV;
        }

    }
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
public final boolean validate(){
    // Do validation if all of the following are true:
    // 1. The JAXP Schema Language property is not XML Schema
    //    REVISIT: since only DTD and Schema are supported at this time,
    //             such checking is sufficient. but if more schema types
    //             are introduced in the future, we'll need to change it
    //             to something like
    //             (fSchemaType == null || fSchemaType == NS_XML_DTD)
    // 2. One of the following is true (validation features)
    // 2.1 Dynamic validation is off, and validation is on
    // 2.2 Dynamic validation is on, and DOCTYPE was seen
    // 3 Xerces schema validation feature is off, or DOCTYPE was seen.
    return (fSchemaType != Constants.NS_XMLSCHEMA) && 
           (!fDynamicValidation && fValidation ||
            fDynamicValidation && fSeenDoctypeDecl) &&
           (fDTDValidation || fSeenDoctypeDecl);
}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
/**
 * Sets the value of a property. This method is called by the component
 * manager any time after reset when a property changes value.
 * <p>
 * <strong>Note:</strong> Components should silently ignore properties
 * that do not affect the operation of the component.
 *
 * @param propertyId The property identifier.
 * @param value      The value of the property.
 *
 * @throws SAXNotRecognizedException The component should not throw
 *                                   this exception.
 * @throws SAXNotSupportedException The component should not throw
 *                                  this exception.
 */
public void setProperty(String propertyId, Object value)
    throws XMLConfigurationException {

    // Xerces properties
    if (propertyId.startsWith(Constants.XERCES_PROPERTY_PREFIX)) {
    	final int suffixLength = propertyId.length() - Constants.XERCES_PROPERTY_PREFIX.length();
    	
        if (suffixLength == Constants.SECURITY_MANAGER_PROPERTY.length() && 
            propertyId.endsWith(Constants.SECURITY_MANAGER_PROPERTY)) {
            fSecurityManager = (SecurityManager)value;                
            maxNodeLimit = (fSecurityManager != null) ? fSecurityManager.getMaxOccurNodeLimit() * MULTIPLICITY : 0 ;
            return;
        }
        if (suffixLength == Constants.ERROR_REPORTER_PROPERTY.length() && 
            propertyId.endsWith(Constants.ERROR_REPORTER_PROPERTY)) {
            fErrorReporter = (XMLErrorReporter)value;
            return;
        }
    }

}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
public void startGeneralEntity(
    String name,
    XMLResourceIdentifier resId,
    String encoding,
    Augmentations augs)
    throws XNIException {
    if (getState() == STATE_NORMAL_PROCESSING) {
        if (fResultDepth == 0) {
            if (augs != null && Boolean.TRUE.equals(augs.getItem(Constants.ENTITY_SKIPPED))) {
                reportFatalError("UnexpandedEntityReferenceIllegal");
            }
        }
        else if (fDocumentHandler != null) {
            fDocumentHandler.startGeneralEntity(name, resId, encoding, augs);
        }
    }
}
 

import org.apache.xerces.impl.Constants; //导入依赖的package包/类
private void processPSVINamespaceItem(XSNamespaceItem item) {
    if (item == null)
        return;

    String namespace = item.getSchemaNamespace();
    if (namespace != null && namespace.equals(Constants.NS_XMLSCHEMA)) {
        // we don't want to output information for schema for schemas
        return;
    }

    sendIndentedElement("psv:namespaceSchemaInformation");
    sendElementEvent("psv:schemaNamespace", namespace);

    // print out schema components
    processPSVISchemaComponents(item);

    // print out schema document information
    processPSVISchemaDocuments(item);

    // print out schema annotations
    processPSVISchemaAnnotations(item.getAnnotations());
    sendUnIndentedElement("psv:namespaceSchemaInformation");
}