add implicit built-in xml schema.

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 0850023..c5293d0 100644 (file)
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -5,6 +5,7 @@ TogaGem 変更履歴
 
 
 X.XXX.X (XXXX-XX-XX)
 
 
 X.XXX.X (XXXX-XX-XX)

+    * Prevent XXE vulnerabilities.

     * Split entity resolver from resource resolver to prevent XXE vulnerability.
     * Make Schema-factory safe to prevent XXE vulnerability.
     * Move out xml-xsd info from resolver.
     * Split entity resolver from resource resolver to prevent XXE vulnerability.
     * Make Schema-factory safe to prevent XXE vulnerability.
     * Move out xml-xsd info from resolver.

diff --git a/src/main/java/jp/sfjp/mikutoga/xml/SchemaUtil.java b/src/main/java/jp/sfjp/mikutoga/xml/SchemaUtil.java
index c2de190..a8dbadf 100644 (file)
--- a/src/main/java/jp/sfjp/mikutoga/xml/SchemaUtil.java
+++ b/src/main/java/jp/sfjp/mikutoga/xml/SchemaUtil.java
@@ -26,7 +26,7 @@ import org.xml.sax.SAXNotRecognizedException;
 import org.xml.sax.SAXNotSupportedException;
 
 /**
 import org.xml.sax.SAXNotSupportedException;
 
 /**

- * XMLスキーマの各種ビルダ。
+ * XML schema (XSD) utilities.

  */
 public final class SchemaUtil {
 
  */
 public final class SchemaUtil {
 


@@ -62,7 +62,7 @@ public final class SchemaUtil {
 
 
     /**
 
 
     /**

-     * 隠しコンストラクタ。
+     * Hidden constructor.

      */
     private SchemaUtil(){
         assert false;
      */
     private SchemaUtil(){
         assert false;


@@ -184,10 +184,14 @@ public final class SchemaUtil {
      * @param resArray ローカルスキーマ情報並び
      * @return スキーマ
      */
      * @param resArray ローカルスキーマ情報並び
      * @return スキーマ
      */

-    public static Schema newSchema(XmlResourceResolver resolver,
-                                    LocalXmlResource... resArray ){
+    public static Schema newSchema(
+            XmlResourceResolver resolver,
+            LocalXmlResource... resArray){
+        XmlResourceResolver totalResolver = buildXmlXsdResolver();
+        totalResolver.putRedirected(resolver);
+

         for(LocalXmlResource resource : resArray){
         for(LocalXmlResource resource : resArray){

-            resolver.putRedirected(resource);
+            totalResolver.putRedirected(resource);

         }
 
         Source[] sources;
         }
 
         Source[] sources;


@@ -198,7 +202,7 @@ public final class SchemaUtil {
             throw new AssertionError(e);
         }
 
             throw new AssertionError(e);
         }
 

-        SchemaFactory schemaFactory = newSchemaFactory(resolver);
+        SchemaFactory schemaFactory = newSchemaFactory(totalResolver);

 
         Schema result;
         try{
 
         Schema result;
         try{