Package com.predic8.membrane.core.interceptor.xmlprotection

Class XMLProtector

java.lang.Object

com.predic8.membrane.core.interceptor.xmlprotection.XMLProtector

public class XMLProtector
extends Object

Filters XML streams, removing potentially malicious elements:

• DTDs can be removed.
• The length of element names can be limited.
• The number of attibutes per element can be limited.

If protect(InputStreamReader) returns false, an unrecoverable error has occurred (such as not-wellformed XML or an element name length exceeded the limit), the OutputStreamWriter is left at this position: It should be discarded and an error response should be returned to the requestor.

Constructor Summary

Constructors

Constructor	Description
XMLProtector(OutputStreamWriter osw, boolean removeDTD, int maxElementNameLength, int maxAttibuteCount)

Method Summary

Modifier and Type	Method	Description
boolean	protect(InputStreamReader isr)	Is XML secure?

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

XMLProtector

public XMLProtector(OutputStreamWriter osw,
 boolean removeDTD,
 int maxElementNameLength,
 int maxAttibuteCount)
             throws Exception

Throws:

Exception

Method Details

protect

public boolean protect(InputStreamReader isr)
                throws XMLProtectionException

Is XML secure?

Parameters:

isr - Stream with XML

Returns:

false if there is any security problem in the XML

Throws:

XMLProtectionException - if there are critical issues like external entity references