Open
Description
The WstxSAXParser constructor seems to mostly ignore configuration from the provided factory and uses some fixed values:
It looks like the doSupportDTDs and resolver could have been inherited from the factory here.
Example code to reproduce:
WstxInputFactory inputFactory = new WstxInputFactory();
inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, true);
inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, true);
inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, true);
inputFactory.setXMLResolver(new XMLResolver() {
@Override
public Object resolveEntity(String publicID, String systemID, String baseURI, String namespace)
throws XMLStreamException {
return "";
}
});
WstxSAXParserFactory factory = new WstxSAXParserFactory(xmlInputFactory);
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
...
//expectation: this parser is configured as per above configuration and quietly ignores external entities, it does not work unless the resolver is set again on the parser itself explicitly
factory .newSAXParser();
The handling of the features flags in WstxSAXParser is also a bit suspicious as most seem to have a fixed value rather than reflecting the factory features.