View Javadoc
1   /*
2    * Licensed to the Apache Software Foundation (ASF) under one or more
3    * contributor license agreements.  See the NOTICE file distributed with
4    * this work for additional information regarding copyright ownership.
5    * The ASF licenses this file to You under the Apache License, Version 2.0
6    * (the "License"); you may not use this file except in compliance with
7    * the License.  You may obtain a copy of the License at
8    *
9    *      https://www.apache.org/licenses/LICENSE-2.0
10   *
11   * Unless required by applicable law or agreed to in writing, software
12   * distributed under the License is distributed on an "AS IS" BASIS,
13   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14   * See the License for the specific language governing permissions and
15   * limitations under the License.
16   */
17  
18  package org.apache.commons.xml.secure;
19  
20  import java.util.Objects;
21  
22  import javax.xml.validation.TypeInfoProvider;
23  import javax.xml.validation.ValidatorHandler;
24  
25  import org.w3c.dom.ls.LSResourceResolver;
26  import org.xml.sax.Attributes;
27  import org.xml.sax.ContentHandler;
28  import org.xml.sax.ErrorHandler;
29  import org.xml.sax.Locator;
30  import org.xml.sax.SAXException;
31  import org.xml.sax.SAXNotRecognizedException;
32  import org.xml.sax.SAXNotSupportedException;
33  
34  /**
35   * {@link ValidatorHandler} wrapper that keeps an ignore-all {@link LSResourceResolver} floor a caller cannot remove.
36   *
37   * <p>Blocks {@code xsi:schemaLocation} resolution during SAX-driven validation. A caller-set resolver is routed through a {@link
38   * FallbackIgnoreLSResourceResolver} rather than replacing the floor, so a schema the caller does not resolve resolves to empty instead of being fetched.</p>
39   */
40  final class SecureValidatorHandler extends ValidatorHandler {
41  
42      private final ValidatorHandler delegate;
43  
44      private final FallbackIgnoreLSResourceResolver floor = new FallbackIgnoreLSResourceResolver(null);
45  
46      /**
47       * Constructs a new instance.
48       *
49       * @param delegate the delegate to wrap; must not be {@code null}.
50       * @throws NullPointerException if {@code delegate} is {@code null}.
51       */
52      SecureValidatorHandler(final ValidatorHandler delegate) {
53          this.delegate = Objects.requireNonNull(delegate, "delegate");
54          delegate.setResourceResolver(floor);
55      }
56  
57      @Override
58      public void characters(final char[] ch, final int start, final int length) throws SAXException {
59          delegate.characters(ch, start, length);
60      }
61  
62      @Override
63      public void endDocument() throws SAXException {
64          delegate.endDocument();
65      }
66  
67      @Override
68      public void endElement(final String uri, final String localName, final String qName) throws SAXException {
69          delegate.endElement(uri, localName, qName);
70      }
71  
72      @Override
73      public void endPrefixMapping(final String prefix) throws SAXException {
74          delegate.endPrefixMapping(prefix);
75      }
76  
77      @Override
78      public ContentHandler getContentHandler() {
79          return delegate.getContentHandler();
80      }
81  
82      @Override
83      public ErrorHandler getErrorHandler() {
84          return delegate.getErrorHandler();
85      }
86  
87      @Override
88      public boolean getFeature(final String name) throws SAXNotRecognizedException, SAXNotSupportedException {
89          return delegate.getFeature(name);
90      }
91  
92      @Override
93      public Object getProperty(final String name) throws SAXNotRecognizedException, SAXNotSupportedException {
94          return delegate.getProperty(name);
95      }
96  
97      @Override
98      public LSResourceResolver getResourceResolver() {
99          return floor.getDelegate();
100     }
101 
102     @Override
103     public TypeInfoProvider getTypeInfoProvider() {
104         return delegate.getTypeInfoProvider();
105     }
106 
107     @Override
108     public void ignorableWhitespace(final char[] ch, final int start, final int length) throws SAXException {
109         delegate.ignorableWhitespace(ch, start, length);
110     }
111 
112     @Override
113     public void processingInstruction(final String target, final String data) throws SAXException {
114         delegate.processingInstruction(target, data);
115     }
116 
117     @Override
118     public void setContentHandler(final ContentHandler receiver) {
119         delegate.setContentHandler(receiver);
120     }
121 
122     @Override
123     public void setDocumentLocator(final Locator locator) {
124         delegate.setDocumentLocator(locator);
125     }
126 
127     @Override
128     public void setErrorHandler(final ErrorHandler errorHandler) {
129         delegate.setErrorHandler(errorHandler);
130     }
131 
132     @Override
133     public void setFeature(final String name, final boolean value) throws SAXNotRecognizedException, SAXNotSupportedException {
134         delegate.setFeature(name, value);
135     }
136 
137     @Override
138     public void setProperty(final String name, final Object object) throws SAXNotRecognizedException, SAXNotSupportedException {
139         delegate.setProperty(name, object);
140     }
141 
142     @Override
143     public void setResourceResolver(final LSResourceResolver resourceResolver) {
144         floor.setDelegate(resourceResolver);
145     }
146 
147     @Override
148     public void skippedEntity(final String name) throws SAXException {
149         delegate.skippedEntity(name);
150     }
151 
152 
153     @Override
154     public void startDocument() throws SAXException {
155         delegate.startDocument();
156     }
157 
158     @Override
159     public void startElement(final String uri, final String localName, final String qName, final Attributes atts) throws SAXException {
160         delegate.startElement(uri, localName, qName, atts);
161     }
162 
163     @Override
164     public void startPrefixMapping(final String prefix, final String uri) throws SAXException {
165         delegate.startPrefixMapping(prefix, uri);
166     }
167 }