XOM API for Processing XML with Java

[Mike Wilson <mikewse AT hotmail.com>]

Thanks, Elliot 

Is there any way to do this without introducing dependencies to other
libraries? Currently we only depend on XOM and use all its default
behaviour.

And just to double-check; you don't have any solution similar to setFeature
to disable this? You mention in the tutorial that XOM controls f ex
external-general-entities and external-parameter-entities.

Best regards
Mike

Elliotte Rusty Harold wrote:
> It can be done but it's not as easy as it probably should be.
> 
> You'd need to start by setting up a SAX XMLReader configured to use a
> custom EntityResolver that returns the empty string for all 
> entities you
> don't want to load (or just for all entities). Then you pass 
> this to the
> XOM Builder constructor.
> 
> On Tue, Sep 16, 2014 at 5:06 AM, Mike Wilson 
> <mikewse AT hotmail.com> wrote:
> 
> > [resending as subscriber]
> >
> > Hi,
> >
> > We are using XOM to communicate XML over the internet and 
> need to protect
> > ourselves from XML hacks such as mentioned on:
> >  
> <https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29
> _Processing
> > >
> > 
> https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_
> Processing
> >
> > What is the most straight-forward way to configure XOM to 
> achieve this?
> >
> > Currently we are just doing:
> >     Builder builder = new Builder();
> >     Document doc = builder.build(new StringReader(xmlstr));
> >
> > Thanks
> > Mike
> > _______________________________________________
> > XOM-interest mailing list
> > XOM-interest AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> >
> 
> 
> 
> -- 
> Elliotte Rusty Harold
> elharo AT ibiblio.org
> _______________________________________________
> XOM-interest mailing list
> XOM-interest AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/xom-interest
>