[DOXIA-716] Update and unify XMLReader creation and configuration #187
Conversation
doxia-core/src/test/java/org/apache/maven/doxia/xsd/AbstractXmlValidator.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
looks good to me.
While we are here maybe something for parsing and later for validation can be hardened:
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
This should be separate, please file a JIRA issue. |
| */ | ||
| private XMLReader getXmlReader(boolean hasDtdAndXsd) throws SAXException { | ||
| public XMLReader getXmlReader() throws SAXException, ParserConfigurationException { | ||
| if (xmlReader == null) { |
There was a problem hiding this comment.
I am not sure if caching is wise here, as SAXParser/SAXParserFactory is not not thread-safe AFAIK (https://docs.oracle.com/cd/E17802_01/webservices/webservices/docs/1.5/api/javax/xml/parsers/SAXParserFactory.html). At least this should be documented in the javadoc that the returned XMLReader needs to be synchronized somehow to be used among multiple threads.
There was a problem hiding this comment.
No objections, but that would be a behavioral change and should be a separate issue.
This closes #187