java - Set feature accessExternalDTD in TransformerFactory

Question

For security reasons I'm adding the statement:

transformerFactory.setFeature("http://javax.xml.XMLConstants/property/accessExternalDTD", false);

However I'm getting the following error in the log files:

25-Nov-2014 09:35:48.802 SEVERE [http-nio-8080-exec-14] CIMObject.CIMObjectCollectDataHANA.setRunningXML TransformerConfigurationException setRunningXMLHANA: javax.xml.transform.TransformerConfigurationException: Cannot set the feature 'http://javax.xml.XMLConstants/property/accessExternalDTD' on this TransformerFactory.

Someone experienced the same error and was able to fix it?

Answer 1

It appears the problem is that such feature is not defined in com/sun/org/apache/xalan/internal/utils/FeatureManager.java.

If you are using java 8, then what you need to do is simply to call:

transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

This is because in com/sun/org/apache/xalan/internal/xsltctrax/TransformerFactoryImpl.java:

if (value && XalanConstants.IS_JDK8_OR_ABOVE) {
    _xmlSecurityPropertyMgr.setValue(
         Property.ACCESS_EXTERNAL_DTD, 
         State.FSP, 
         XalanConstants.EXTERNAL_ACCESS_DEFAULT_FSP
    ); // ACCESS_EXTERNAL_DTD is disabled by setting to the default value
 }