001//////////////////////////////////////////////////////////////////////////////// 002// checkstyle: Checks Java source code for adherence to a set of rules. 003// Copyright (C) 2001-2017 the original author or authors. 004// 005// This library is free software; you can redistribute it and/or 006// modify it under the terms of the GNU Lesser General Public 007// License as published by the Free Software Foundation; either 008// version 2.1 of the License, or (at your option) any later version. 009// 010// This library is distributed in the hope that it will be useful, 011// but WITHOUT ANY WARRANTY; without even the implied warranty of 012// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 013// Lesser General Public License for more details. 014// 015// You should have received a copy of the GNU Lesser General Public 016// License along with this library; if not, write to the Free Software 017// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 018//////////////////////////////////////////////////////////////////////////////// 019 020package com.puppycrawl.tools.checkstyle.api; 021 022import java.io.IOException; 023import java.io.InputStream; 024import java.util.HashMap; 025import java.util.Map; 026 027import javax.xml.parsers.ParserConfigurationException; 028import javax.xml.parsers.SAXParserFactory; 029 030import org.xml.sax.InputSource; 031import org.xml.sax.SAXException; 032import org.xml.sax.SAXParseException; 033import org.xml.sax.XMLReader; 034import org.xml.sax.helpers.DefaultHandler; 035 036/** 037 * Contains the common implementation of a loader, for loading a configuration 038 * from an XML file. 039 * <p> 040 * The error handling policy can be described as being austere, dead set, 041 * disciplinary, dour, draconian, exacting, firm, forbidding, grim, hard, hard- 042 * boiled, harsh, harsh, in line, iron-fisted, no-nonsense, oppressive, 043 * persnickety, picky, prudish, punctilious, puritanical, rigid, rigorous, 044 * scrupulous, set, severe, square, stern, stickler, straight, strait-laced, 045 * stringent, stuffy, stuffy, tough, unpermissive, unsparing and uptight. 046 * </p> 047 * 048 * @author Oliver Burn 049 */ 050public abstract class AbstractLoader 051 extends DefaultHandler { 052 /** Feature that enables loading external DTD when loading XML files. */ 053 private static final String LOAD_EXTERNAL_DTD = 054 "http://apache.org/xml/features/nonvalidating/load-external-dtd"; 055 /** Feature that enables including external general entities in XML files. */ 056 private static final String EXTERNAL_GENERAL_ENTITIES = 057 "http://xml.org/sax/features/external-general-entities"; 058 /** Maps public id to resolve to resource name for the DTD. */ 059 private final Map<String, String> publicIdToResourceNameMap; 060 /** Parser to read XML files. **/ 061 private final XMLReader parser; 062 063 /** 064 * Creates a new instance. 065 * @param publicId the public ID for the DTD to resolve 066 * @param dtdResourceName the resource for the DTD 067 * @throws SAXException if an error occurs 068 * @throws ParserConfigurationException if an error occurs 069 */ 070 protected AbstractLoader(String publicId, String dtdResourceName) 071 throws SAXException, ParserConfigurationException { 072 this(new HashMap<>(1)); 073 publicIdToResourceNameMap.put(publicId, dtdResourceName); 074 } 075 076 /** 077 * Creates a new instance. 078 * @param publicIdToResourceNameMap maps public IDs to DTD resource names 079 * @throws SAXException if an error occurs 080 * @throws ParserConfigurationException if an error occurs 081 */ 082 protected AbstractLoader(Map<String, String> publicIdToResourceNameMap) 083 throws SAXException, ParserConfigurationException { 084 this.publicIdToResourceNameMap = new HashMap<>(publicIdToResourceNameMap); 085 final SAXParserFactory factory = SAXParserFactory.newInstance(); 086 LoadExternalDtdFeatureProvider.setFeaturesBySystemProperty(factory); 087 factory.setValidating(true); 088 factory.setNamespaceAware(true); 089 parser = factory.newSAXParser().getXMLReader(); 090 parser.setContentHandler(this); 091 parser.setEntityResolver(this); 092 parser.setErrorHandler(this); 093 } 094 095 /** 096 * Parses the specified input source. 097 * @param inputSource the input source to parse. 098 * @throws IOException if an error occurs 099 * @throws SAXException in an error occurs 100 */ 101 public void parseInputSource(InputSource inputSource) 102 throws IOException, SAXException { 103 parser.parse(inputSource); 104 } 105 106 @Override 107 public InputSource resolveEntity(String publicId, String systemId) 108 throws SAXException, IOException { 109 final InputSource inputSource; 110 if (publicIdToResourceNameMap.keySet().contains(publicId)) { 111 final String dtdResourceName = 112 publicIdToResourceNameMap.get(publicId); 113 final ClassLoader loader = 114 getClass().getClassLoader(); 115 final InputStream dtdIs = 116 loader.getResourceAsStream(dtdResourceName); 117 118 inputSource = new InputSource(dtdIs); 119 } 120 else { 121 inputSource = super.resolveEntity(publicId, systemId); 122 } 123 return inputSource; 124 } 125 126 @Override 127 public void error(SAXParseException exception) throws SAXException { 128 throw exception; 129 } 130 131 @Override 132 public void fatalError(SAXParseException exception) throws SAXException { 133 throw exception; 134 } 135 136 /** 137 * Used for setting specific for secure java installations features to SAXParserFactory. 138 * Pulled out as a separate class in order to suppress Pitest mutations. 139 */ 140 public static final class LoadExternalDtdFeatureProvider { 141 142 /** System property name to enable external DTD load. */ 143 public static final String ENABLE_EXTERNAL_DTD_LOAD = "checkstyle.enableExternalDtdLoad"; 144 145 /** Feature that enables loading external DTD when loading XML files. */ 146 private static final String LOAD_EXTERNAL_DTD = 147 "http://apache.org/xml/features/nonvalidating/load-external-dtd"; 148 /** Feature that enables including external general entities in XML files. */ 149 private static final String EXTERNAL_GENERAL_ENTITIES = 150 "http://xml.org/sax/features/external-general-entities"; 151 152 /** Stop instances being created. **/ 153 private LoadExternalDtdFeatureProvider() { 154 } 155 156 /** 157 * Configures SAXParserFactory with features required 158 * to use external DTD file loading, this is not activated by default to no allow 159 * usage of schema files that checkstyle do not know 160 * it is even security problem to allow files from outside. 161 * @param factory factory to be configured with special features 162 * @throws SAXException if an error occurs 163 * @throws ParserConfigurationException if an error occurs 164 */ 165 public static void setFeaturesBySystemProperty(SAXParserFactory factory) 166 throws SAXException, ParserConfigurationException { 167 168 final boolean enableExternalDtdLoad = Boolean.valueOf( 169 System.getProperty(ENABLE_EXTERNAL_DTD_LOAD, "false")); 170 171 factory.setFeature(LOAD_EXTERNAL_DTD, enableExternalDtdLoad); 172 factory.setFeature(EXTERNAL_GENERAL_ENTITIES, enableExternalDtdLoad); 173 } 174 } 175}