Path: csiph.com!aioe.org!.POSTED!not-for-mail
From: =?UTF-8?Q?Arne_Vajh=c3=b8j?= <arne@vajhoej.dk>
Newsgroups: comp.lang.java.programmer
Subject: Re: JAXP throws "javax.net.ssl.SSLHandshakeException" accessing local file???
Date: Sat, 5 Mar 2016 23:55:03 -0500
Organization: Aioe.org NNTP Server
Lines: 65
Message-ID: <nbgd7d$1t9k$1@gioia.aioe.org>
References: <55d4756d-d28d-4e11-9196-b751f3f92fda@googlegroups.com> <5390e348$0$295$14726298@news.sunsite.dk> <d6b16c31-aba0-46eb-a89c-ac9bc0c36142@googlegroups.com> <1bb4fc78-76b2-421f-9b57-225543d43fed@googlegroups.com>
NNTP-Posting-Host: ANasIS7Js9OyLQwgloeBLQ.user.gioia.aioe.org
Mime-Version: 1.0
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
X-Complaints-To: abuse@aioe.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0
X-Notice: Filtered by postfilter v. 0.8.2
Xref: csiph.com comp.lang.java.programmer:33937

On 3/3/2016 9:37 AM, eli.milanova@gmail.com wrote:
> On Friday, 6 June 2014 00:58:44 UTC+3, Robert Smith  wrote:
>> As it turns out:
>>
>> factory.setValidating(false);
>>
>> does not prevent using the DTD, but:
>> 		factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
>>
>> does.
>
> You are perfect!!! 3 days struggling and finally saw your answer... Saved my life!!! THANK YOU!

I think:

factory.setValidating(false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", 
false);
DocumentBuilder builder = dbf.newDocumentBuilder();

should be coded as:

factory.setValidating(false);
if(factory.getClass().getName().startsWith("org.apache.xerces")) {
 
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", 
false);
} else {
     throw new RuntimeException("This code only works with Xerces 
(default JAXP implementation in newer Java SE)");
}
DocumentBuilder builder = dbf.newDocumentBuilder();

or:

factory.setValidating(false);
DocumentBuilder builder = dbf.newDocumentBuilder();
builder.setEntityResolver(new DTDIgnoreURLPrefix("https://")); // or 
whatever suitable

...

	public static class DTDIgnoreURLPrefix implements EntityResolver {
		private String prefix;
		public DTDIgnoreURLPrefix(String prefix) {
			this.prefix = prefix;
		}
	    @Override
	    public InputSource resolveEntity(String publicId, String systemId) 
throws SAXException, IOException {
	    	if(systemId.startsWith(prefix)) {
	            return new InputSource(new StringReader(""));
	        } else {
	            return null;
	        }
	    }
	}

Arne