Using ph- methods where applicable

phax · Dec 13, 2024 · 569a7e0 · 569a7e0
1 parent 6217729
commit 569a7e0
Show file tree

Hide file tree

Showing 7 changed files with 108 additions and 124 deletions.
diff --git a/phase4-lib/src/main/java/com/helger/phase4/messaging/mime/DataContentHandlerSoap12.java b/phase4-lib/src/main/java/com/helger/phase4/messaging/mime/DataContentHandlerSoap12.java
@@ -18,6 +18,7 @@
 
 import java.io.IOException;
 import java.io.OutputStream;
+import java.util.Locale;
 
 import javax.annotation.Nonnull;
 import javax.annotation.WillNotClose;
@@ -31,7 +32,10 @@
 import org.eclipse.angus.mail.handlers.text_plain;
 
 import com.helger.commons.annotation.ReturnsMutableObject;
+import com.helger.commons.collection.ArrayHelper;
 import com.helger.phase4.model.ESoapVersion;
+import com.helger.xml.transform.LoggingTransformErrorListener;
+import com.helger.xml.transform.XMLTransformerFactory;
 
 import jakarta.activation.ActivationDataFlavor;
 import jakarta.activation.DataSource;
@@ -58,25 +62,28 @@ public class DataContentHandlerSoap12 extends text_plain
 
   @Override
   @Nonnull
-  protected Object getData (@Nonnull final ActivationDataFlavor aFlavor, @Nonnull final DataSource aDataSource)
-                                                                                                                throws IOException
+  protected Object getData (@Nonnull final ActivationDataFlavor aFlavor,
+                            @Nonnull final DataSource aDataSource) throws IOException
   {
     if (aFlavor.getRepresentationClass () == StreamSource.class)
       return new StreamSource (aDataSource.getInputStream ());
 
     throw new IOException ("Unsupported flavor " + aFlavor + " on DS " + aDataSource);
   }
 
-  /**
-   */
   @Override
   public void writeTo (@Nonnull final Object aObj,
                        @Nonnull final String sMimeType,
                        @Nonnull @WillNotClose final OutputStream aOS) throws IOException
   {
     try
     {
-      final Transformer aTransformer = TransformerFactory.newInstance ().newTransformer ();
+      // Here we can use a secure transformer factory
+      final TransformerFactory aFactory = XMLTransformerFactory.createTransformerFactory (new LoggingTransformErrorListener (Locale.ROOT),
+                                                                                          null);
+      XMLTransformerFactory.makeTransformerFactorySecure (aFactory, ArrayHelper.EMPTY_STRING_ARRAY);
+      final Transformer aTransformer = XMLTransformerFactory.newTransformer (aFactory);
+
       final StreamResult aStreamResult = new StreamResult (aOS);
       if (aObj instanceof DataSource)
       {

diff --git a/phase4-lib/src/main/java/com/helger/phase4/util/AS4XMLHelper.java b/phase4-lib/src/main/java/com/helger/phase4/util/AS4XMLHelper.java
@@ -16,8 +16,9 @@
  */
 package com.helger.phase4.util;
 
+import java.util.Locale;
+
 import javax.annotation.Nonnull;
-import javax.xml.XMLConstants;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
 import javax.xml.transform.TransformerFactory;
@@ -27,12 +28,15 @@
 import org.w3c.dom.Node;
 
 import com.helger.commons.ValueEnforcer;
+import com.helger.commons.collection.ArrayHelper;
 import com.helger.commons.io.stream.NonBlockingStringWriter;
 import com.helger.phase4.marshaller.Ebms3NamespaceHandler;
 import com.helger.xml.serialize.write.EXMLSerializeIndent;
 import com.helger.xml.serialize.write.EXMLSerializeXMLDeclaration;
 import com.helger.xml.serialize.write.XMLWriter;
 import com.helger.xml.serialize.write.XMLWriterSettings;
+import com.helger.xml.transform.LoggingTransformErrorListener;
+import com.helger.xml.transform.XMLTransformerFactory;
 
 /**
  * AS4 XML helper methods.
@@ -63,10 +67,10 @@ private static String _serializeRT (@Nonnull final Node aNode)
   {
     try
     {
-      final TransformerFactory tf = TransformerFactory.newInstance ();
-      tf.setAttribute (XMLConstants.ACCESS_EXTERNAL_DTD, "");
-      tf.setAttribute (XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
-      final Transformer aTransformer = tf.newTransformer ();
+      final TransformerFactory aFactory = XMLTransformerFactory.createTransformerFactory (new LoggingTransformErrorListener (Locale.ROOT),
+                                                                                          null);
+      XMLTransformerFactory.makeTransformerFactorySecure (aFactory, ArrayHelper.EMPTY_STRING_ARRAY);
+      final Transformer aTransformer = aFactory.newTransformer ();
 
       try (final NonBlockingStringWriter aSW = new NonBlockingStringWriter ())
       {

diff --git a/phase4-lib/src/test/java/com/helger/phase4/client/MainOldAS4Client.java b/phase4-lib/src/test/java/com/helger/phase4/client/MainOldAS4Client.java
@@ -16,15 +16,8 @@
  */
 package com.helger.phase4.client;
 
-import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
-import javax.xml.parsers.ParserConfigurationException;
-
 import org.apache.hc.client5.http.classic.methods.HttpPost;
 import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
 import org.apache.hc.core5.http.ContentType;
@@ -34,7 +27,6 @@
 import org.slf4j.LoggerFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Node;
-import org.xml.sax.SAXException;
 
 import com.helger.commons.collection.impl.CommonsArrayList;
 import com.helger.commons.collection.impl.ICommonsList;
@@ -67,25 +59,12 @@ public final class MainOldAS4Client
   private MainOldAS4Client ()
   {}
 
-  @Nullable
-  public static Document getSoapEnvelope11ForTest (@Nonnull final String sPath) throws SAXException,
-                                                                                IOException,
-                                                                                ParserConfigurationException
-  {
-    final DocumentBuilderFactory domFactory = DocumentBuilderFactory.newInstance ();
-    // never forget this!
-    domFactory.setNamespaceAware (true);
-    final DocumentBuilder builder = domFactory.newDocumentBuilder ();
-    return builder.parse (new ClassPathResource (sPath).getInputStream ());
-  }
-
   /**
    * Starting point for the SAAJ - SOAP Client Testing
    *
    * @param args
    *        ignored
    */
-  @SuppressWarnings ("resource")
   public static void main (final String [] args)
   {
     try (final AS4ResourceHelper aResHelper = new AS4ResourceHelper ())