Package org.synchronoss.cpo.core.helper

Class XmlHelper

java.lang.Object
org.synchronoss.cpo.core.helper.XmlHelper
public class XmlHelper extends Object
Static helpers for locating and safely unmarshalling CPO's XML configuration and meta data files.

loadXmlStream(java.lang.String, java.lang.StringBuilder) resolves an XML source by classpath resource, file: URL, or plain filesystem path — never over the network, so a hostile CPO_CONFIG value cannot pull configuration from a remote host. unmarshalXmlObject(java.lang.String, java.lang.String, java.lang.Class<T>, java.lang.StringBuilder) then parses and schema-validates that XML through a hardened SAX/JAXB pipeline with DOCTYPE declarations and external entities disabled, to prevent XXE and entity-expansion attacks from untrusted config or meta XML.

Author:
dberry

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    CPO_CONFIG_XSD
    Classpath-relative location of the CPO config XML schema.
    static final String
    CPO_META_XSD
    Classpath-relative location of the CPO meta data XML schema.

  • Method Summary

    Modifier and Type
    Method
    Description
    static InputStream
    loadXmlStream(String xmlStr, StringBuilder errorBuilder)
    Resolves xmlStr to an open InputStream, trying (in order) a file: URL, a classpath resource, and finally a plain filesystem path.
    static void
    setMarshallerProperties(jakarta.xml.bind.Marshaller marshaller)
    Configures a JAXB Marshaller with CPO's standard output settings: UTF-8 encoding and formatted (indented) output.
    static <T> T
    unmarshalXmlObject(String xsd, String xml, Class<T> objClass, StringBuilder errorBuilder)
    Loads, schema-validates, and unmarshals an XML document into an instance of objClass, using a hardened SAX parser (DOCTYPE and external entities disabled) to guard against XXE and entity-expansion attacks from untrusted input.

    Methods inherited from class java.lang.Object

    equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • CPO_META_XSD

      public static final String CPO_META_XSD
      Classpath-relative location of the CPO meta data XML schema.
      See Also:

    • CPO_CONFIG_XSD

      public static final String CPO_CONFIG_XSD
      Classpath-relative location of the CPO config XML schema.
      See Also:

  • Method Details

    • loadXmlStream

      public static InputStream loadXmlStream(String xmlStr, StringBuilder errorBuilder)
      Resolves xmlStr to an open InputStream, trying (in order) a file: URL, a classpath resource, and finally a plain filesystem path. Remote URLs are deliberately not supported.
      Parameters:
      xmlStr - the classpath resource name, file: URL, or filesystem path to load
      errorBuilder - buffer that error details are appended to when the source cannot be resolved; left unchanged on success
      Returns:
      an open stream for xmlStr, or null if it could not be resolved by any of the supported means

    • setMarshallerProperties

      public static void setMarshallerProperties(jakarta.xml.bind.Marshaller marshaller) throws jakarta.xml.bind.PropertyException
      Configures a JAXB Marshaller with CPO's standard output settings: UTF-8 encoding and formatted (indented) output.
      Parameters:
      marshaller - the marshaller to configure
      Throws:
      jakarta.xml.bind.PropertyException - if the marshaller does not support one of the properties being set

    • unmarshalXmlObject

      public static <T> T unmarshalXmlObject(String xsd, String xml, Class<T> objClass, StringBuilder errorBuilder)
      Loads, schema-validates, and unmarshals an XML document into an instance of objClass, using a hardened SAX parser (DOCTYPE and external entities disabled) to guard against XXE and entity-expansion attacks from untrusted input.
      Type Parameters:
      T - the JAXB-bound type to unmarshal into
      Parameters:
      xsd - the classpath resource, file: URL, or path of the XSD to validate against
      xml - the classpath resource, file: URL, or path of the XML document to parse
      objClass - the JAXB-bound class to unmarshal the document into
      errorBuilder - buffer that validation and I/O error details are appended to
      Returns:
      the unmarshalled object, or null if the XSD/XML could not be loaded or parsed