001////////////////////////////////////////////////////////////////////////////////
002// checkstyle: Checks Java source code for adherence to a set of rules.
003// Copyright (C) 2001-2017 the original author or authors.
004//
005// This library is free software; you can redistribute it and/or
006// modify it under the terms of the GNU Lesser General Public
007// License as published by the Free Software Foundation; either
008// version 2.1 of the License, or (at your option) any later version.
009//
010// This library is distributed in the hope that it will be useful,
011// but WITHOUT ANY WARRANTY; without even the implied warranty of
012// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
013// Lesser General Public License for more details.
014//
015// You should have received a copy of the GNU Lesser General Public
016// License along with this library; if not, write to the Free Software
017// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
018////////////////////////////////////////////////////////////////////////////////
019
020package com.puppycrawl.tools.checkstyle.api;
021
022import java.io.IOException;
023import java.io.InputStream;
024import java.util.HashMap;
025import java.util.Map;
026
027import javax.xml.parsers.ParserConfigurationException;
028import javax.xml.parsers.SAXParserFactory;
029
030import org.xml.sax.InputSource;
031import org.xml.sax.SAXException;
032import org.xml.sax.SAXParseException;
033import org.xml.sax.XMLReader;
034import org.xml.sax.helpers.DefaultHandler;
035
036/**
037 * Contains the common implementation of a loader, for loading a configuration
038 * from an XML file.
039 * <p>
040 * The error handling policy can be described as being austere, dead set,
041 * disciplinary, dour, draconian, exacting, firm, forbidding, grim, hard, hard-
042 * boiled, harsh, harsh, in line, iron-fisted, no-nonsense, oppressive,
043 * persnickety, picky, prudish, punctilious, puritanical, rigid, rigorous,
044 * scrupulous, set, severe, square, stern, stickler, straight, strait-laced,
045 * stringent, stuffy, stuffy, tough, unpermissive, unsparing and uptight.
046 * </p>
047 *
048 * @author Oliver Burn
049 */
050public abstract class AbstractLoader
051    extends DefaultHandler {
052    /** Feature that enables loading external DTD when loading XML files. */
053    private static final String LOAD_EXTERNAL_DTD =
054        "http://apache.org/xml/features/nonvalidating/load-external-dtd";
055    /** Feature that enables including external general entities in XML files. */
056    private static final String EXTERNAL_GENERAL_ENTITIES =
057        "http://xml.org/sax/features/external-general-entities";
058    /** Maps public id to resolve to resource name for the DTD. */
059    private final Map<String, String> publicIdToResourceNameMap;
060    /** Parser to read XML files. **/
061    private final XMLReader parser;
062
063    /**
064     * Creates a new instance.
065     * @param publicId the public ID for the DTD to resolve
066     * @param dtdResourceName the resource for the DTD
067     * @throws SAXException if an error occurs
068     * @throws ParserConfigurationException if an error occurs
069     */
070    protected AbstractLoader(String publicId, String dtdResourceName)
071            throws SAXException, ParserConfigurationException {
072        this(new HashMap<>(1));
073        publicIdToResourceNameMap.put(publicId, dtdResourceName);
074    }
075
076    /**
077     * Creates a new instance.
078     * @param publicIdToResourceNameMap maps public IDs to DTD resource names
079     * @throws SAXException if an error occurs
080     * @throws ParserConfigurationException if an error occurs
081     */
082    protected AbstractLoader(Map<String, String> publicIdToResourceNameMap)
083            throws SAXException, ParserConfigurationException {
084        this.publicIdToResourceNameMap = new HashMap<>(publicIdToResourceNameMap);
085        final SAXParserFactory factory = SAXParserFactory.newInstance();
086        LoadExternalDtdFeatureProvider.setFeaturesBySystemProperty(factory);
087        factory.setValidating(true);
088        factory.setNamespaceAware(true);
089        parser = factory.newSAXParser().getXMLReader();
090        parser.setContentHandler(this);
091        parser.setEntityResolver(this);
092        parser.setErrorHandler(this);
093    }
094
095    /**
096     * Parses the specified input source.
097     * @param inputSource the input source to parse.
098     * @throws IOException if an error occurs
099     * @throws SAXException in an error occurs
100     */
101    public void parseInputSource(InputSource inputSource)
102            throws IOException, SAXException {
103        parser.parse(inputSource);
104    }
105
106    @Override
107    public InputSource resolveEntity(String publicId, String systemId)
108            throws SAXException, IOException {
109        final InputSource inputSource;
110        if (publicIdToResourceNameMap.keySet().contains(publicId)) {
111            final String dtdResourceName =
112                    publicIdToResourceNameMap.get(publicId);
113            final ClassLoader loader =
114                getClass().getClassLoader();
115            final InputStream dtdIs =
116                loader.getResourceAsStream(dtdResourceName);
117
118            inputSource = new InputSource(dtdIs);
119        }
120        else {
121            inputSource = super.resolveEntity(publicId, systemId);
122        }
123        return inputSource;
124    }
125
126    @Override
127    public void error(SAXParseException exception) throws SAXException {
128        throw exception;
129    }
130
131    @Override
132    public void fatalError(SAXParseException exception) throws SAXException {
133        throw exception;
134    }
135
136    /**
137     * Used for setting specific for secure java installations features to SAXParserFactory.
138     * Pulled out as a separate class in order to suppress Pitest mutations.
139     */
140    public static final class LoadExternalDtdFeatureProvider {
141
142        /** System property name to enable external DTD load. */
143        public static final String ENABLE_EXTERNAL_DTD_LOAD = "checkstyle.enableExternalDtdLoad";
144
145        /** Feature that enables loading external DTD when loading XML files. */
146        private static final String LOAD_EXTERNAL_DTD =
147                "http://apache.org/xml/features/nonvalidating/load-external-dtd";
148        /** Feature that enables including external general entities in XML files. */
149        private static final String EXTERNAL_GENERAL_ENTITIES =
150                "http://xml.org/sax/features/external-general-entities";
151
152        /** Stop instances being created. **/
153        private LoadExternalDtdFeatureProvider() {
154        }
155
156        /**
157         * Configures SAXParserFactory with features required
158         * to use external DTD file loading, this is not activated by default to no allow
159         * usage of schema files that checkstyle do not know
160         * it is even security problem to allow files from outside.
161         * @param factory factory to be configured with special features
162         * @throws SAXException if an error occurs
163         * @throws ParserConfigurationException if an error occurs
164         */
165        public static void setFeaturesBySystemProperty(SAXParserFactory factory)
166                throws SAXException, ParserConfigurationException {
167
168            final boolean enableExternalDtdLoad = Boolean.valueOf(
169                System.getProperty(ENABLE_EXTERNAL_DTD_LOAD, "false"));
170
171            factory.setFeature(LOAD_EXTERNAL_DTD, enableExternalDtdLoad);
172            factory.setFeature(EXTERNAL_GENERAL_ENTITIES, enableExternalDtdLoad);
173        }
174    }
175}