Package com.predic8.membrane.core.interceptor.xmlprotection

Class XMLProtectionInterceptor

java.lang.Object

com.predic8.membrane.core.interceptor.AbstractInterceptor

com.predic8.membrane.core.interceptor.xmlprotection.XMLProtectionInterceptor

All Implemented Interfaces:

Interceptor

public class XMLProtectionInterceptor
extends AbstractInterceptor

Description

Prohibits XML documents to be passed through that look like XML attacks on older parsers. Too many attributes, too long element names are such indications. DTD definitions will simply be removed.

Topic

6. Security

Nested Class Summary

Nested classes/interfaces inherited from interface com.predic8.membrane.core.interceptor.Interceptor

Interceptor.Flow

Field Summary

Fields

Modifier and Type	Field	Description
static final String	X_PROTECTION

Fields inherited from class com.predic8.membrane.core.interceptor.AbstractInterceptor

name, router

Constructor Summary

Constructors

Constructor	Description
XMLProtectionInterceptor()

Method Summary

Modifier and Type	Method	Description
String	getShortDescription()
Outcome	handleRequest(Exchange exc)
void	setMaxAttributeCount(int maxAttributeCount)
void	setMaxElementNameLength(int maxElementNameLength)
void	setRemoveDTD(boolean removeDTD)

Methods inherited from class com.predic8.membrane.core.interceptor.AbstractInterceptor

getDisplayName, getFlow, getHelpId, getLongDescription, getMessage, getRouter, getRule, handleAbort, handleResponse, init, init, setDisplayName, setFlow

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

X_PROTECTION

public static final String X_PROTECTION

See Also:

• Constant Field Values

Constructor Details

XMLProtectionInterceptor

public XMLProtectionInterceptor()

Method Details

handleRequest

public Outcome handleRequest(Exchange exc)
                      throws Exception

Specified by:

handleRequest in interface Interceptor

Overrides:

handleRequest in class AbstractInterceptor

Throws:

Exception

setMaxAttributeCount

public void setMaxAttributeCount(int maxAttributeCount)

Default

1000

Description

If an incoming request exceeds this limit, it will be discarded.

setMaxElementNameLength

public void setMaxElementNameLength(int maxElementNameLength)

Default

1000

Description

If an incoming request exceeds this limit, it will be discarded.

setRemoveDTD

public void setRemoveDTD(boolean removeDTD)

Default

true

Description

Whether to remove the DTD from incoming requests.

getShortDescription

public String getShortDescription()

Specified by:

getShortDescription in interface Interceptor

Overrides:

getShortDescription in class AbstractInterceptor