Java SecuritySupport.checkAccess方法代码示例

import com.sun.org.apache.xerces.internal.utils.SecuritySupport; //导入方法依赖的package包/类
/**
 * This method is called either from XMLGrammarLoader.loadGrammar or from XMLSchemaValidator.
 * Note: in either case, the EntityManager (or EntityResolvers) are not going to be invoked
 * to resolve the location of the schema in XSDDescription
 * @param desc
 * @param source
 * @param locationPairs
 * @return An XML Schema grammar
 * @throws IOException
 * @throws XNIException
 */
SchemaGrammar loadSchema(XSDDescription desc,
        XMLInputSource source,
        Map locationPairs) throws IOException, XNIException {

    // this should only be done once per invocation of this object;
    // unless application alters JAXPSource in the mean time.
    if(!fJAXPProcessed) {
        processJAXPSchemaSource(locationPairs);
    }

    if (desc.isExternal()) {
        String accessError = SecuritySupport.checkAccess(desc.getExpandedSystemId(), faccessExternalSchema, Constants.ACCESS_EXTERNAL_ALL);
        if (accessError != null) {
            throw new XNIException(fErrorReporter.reportError(XSMessageFormatter.SCHEMA_DOMAIN,
                    "schema_reference.access",
                    new Object[] { SecuritySupport.sanitizePath(desc.getExpandedSystemId()), accessError }, XMLErrorReporter.SEVERITY_ERROR));
        }
    }
    SchemaGrammar grammar = fSchemaHandler.parseSchema(source, desc, locationPairs);

    return grammar;
}
 

import com.sun.org.apache.xerces.internal.utils.SecuritySupport; //导入方法依赖的package包/类
/**
 * This method is called either from XMLGrammarLoader.loadGrammar or from XMLSchemaValidator.
 * Note: in either case, the EntityManager (or EntityResolvers) are not going to be invoked
 * to resolve the location of the schema in XSDDescription
 * @param desc
 * @param source
 * @param locationPairs
 * @return An XML Schema grammar
 * @throws IOException
 * @throws XNIException
 */
SchemaGrammar loadSchema(XSDDescription desc, XMLInputSource source,
        Map<String, LocationArray> locationPairs) throws IOException, XNIException {

    // this should only be done once per invocation of this object;
    // unless application alters JAXPSource in the mean time.
    if(!fJAXPProcessed) {
        processJAXPSchemaSource(locationPairs);
    }

    if (desc.isExternal() && !source.isCreatedByResolver()) {
        String accessError = SecuritySupport.checkAccess(desc.getExpandedSystemId(), faccessExternalSchema, Constants.ACCESS_EXTERNAL_ALL);
        if (accessError != null) {
            throw new XNIException(fErrorReporter.reportError(XSMessageFormatter.SCHEMA_DOMAIN,
                    "schema_reference.access",
                    new Object[] { SecuritySupport.sanitizePath(desc.getExpandedSystemId()), accessError }, XMLErrorReporter.SEVERITY_ERROR));
        }
    }
    SchemaGrammar grammar = fSchemaHandler.parseSchema(source, desc, locationPairs);

    return grammar;
}
 

import com.sun.org.apache.xerces.internal.utils.SecuritySupport; //导入方法依赖的package包/类
/**
 * This method is called either from XMLGrammarLoader.loadGrammar or from XMLSchemaValidator.
 * Note: in either case, the EntityManager (or EntityResolvers) are not going to be invoked
 * to resolve the location of the schema in XSDDescription
 * @param desc
 * @param source
 * @param locationPairs
 * @return An XML Schema grammar
 * @throws IOException
 * @throws XNIException
 */
SchemaGrammar loadSchema(XSDDescription desc, XMLInputSource source,
        Map<String, LocationArray> locationPairs) throws IOException, XNIException {

    // this should only be done once per invocation of this object;
    // unless application alters JAXPSource in the mean time.
    if(!fJAXPProcessed) {
        processJAXPSchemaSource(locationPairs);
    }

    if (desc.isExternal()) {
        String accessError = SecuritySupport.checkAccess(desc.getExpandedSystemId(), faccessExternalSchema, Constants.ACCESS_EXTERNAL_ALL);
        if (accessError != null) {
            throw new XNIException(fErrorReporter.reportError(XSMessageFormatter.SCHEMA_DOMAIN,
                    "schema_reference.access",
                    new Object[] { SecuritySupport.sanitizePath(desc.getExpandedSystemId()), accessError }, XMLErrorReporter.SEVERITY_ERROR));
        }
    }
    SchemaGrammar grammar = fSchemaHandler.parseSchema(source, desc, locationPairs);

    return grammar;
}
 

import com.sun.org.apache.xerces.internal.utils.SecuritySupport; //导入方法依赖的package包/类
/**
 * getSchemaDocument method uses XMLInputSource to parse a schema document.
 * @param schemaNamespace
 * @param schemaSource
 * @param mustResolve
 * @param referType
 * @param referElement
 * @return A schema Element.
 */
private Element getSchemaDocument(String schemaNamespace, XMLInputSource schemaSource,
        boolean mustResolve, short referType, Element referElement) {

    boolean hasInput = true;
    IOException exception = null;
    // contents of this method will depend on the system we adopt for entity resolution--i.e., XMLEntityHandler, EntityHandler, etc.
    Element schemaElement = null;
    try {
        // when the system id and byte stream and character stream
        // of the input source are all null, it's
        // impossible to find the schema document. so we skip in
        // this case. otherwise we'll receive some NPE or
        // file not found errors. but schemaHint=="" is perfectly
        // legal for import.
        if (schemaSource != null &&
                (schemaSource.getSystemId() != null ||
                        schemaSource.getByteStream() != null ||
                        schemaSource.getCharacterStream() != null)) {

            // When the system id of the input source is used, first try to
            // expand it, and check whether the same document has been
            // parsed before. If so, return the document corresponding to
            // that system id.
            XSDKey key = null;
            String schemaId = null;
            if (referType != XSDDescription.CONTEXT_PREPARSE){
                schemaId = XMLEntityManager.expandSystemId(schemaSource.getSystemId(), schemaSource.getBaseSystemId(), false);
                key = new XSDKey(schemaId, referType, schemaNamespace);
                if((schemaElement = (Element)fTraversed.get(key)) != null) {
                    fLastSchemaWasDuplicate = true;
                    return schemaElement;
                }
                if (referType == XSDDescription.CONTEXT_IMPORT || referType == XSDDescription.CONTEXT_INCLUDE
                        || referType == XSDDescription.CONTEXT_REDEFINE) {
                    String accessError = SecuritySupport.checkAccess(schemaId, fAccessExternalSchema, Constants.ACCESS_EXTERNAL_ALL);
                    if (accessError != null) {
                        reportSchemaFatalError("schema_reference.access",
                                new Object[] { SecuritySupport.sanitizePath(schemaId), accessError },
                                referElement);
                    }
                }
            }

            fSchemaParser.parse(schemaSource);
            Document schemaDocument = fSchemaParser.getDocument();
            schemaElement = schemaDocument != null ? DOMUtil.getRoot(schemaDocument) : null;
            return getSchemaDocument0(key, schemaId, schemaElement);
        }
        else {
            hasInput = false;
        }
    }
    catch (IOException ex) {
        exception = ex;
    }
    return getSchemaDocument1(mustResolve, hasInput, schemaSource, referElement, exception);
}
 

import com.sun.org.apache.xerces.internal.utils.SecuritySupport; //导入方法依赖的package包/类
/**
 * getSchemaDocument method uses XMLInputSource to parse a schema document.
 * @param schemaNamespace
 * @param schemaSource
 * @param mustResolve
 * @param referType
 * @param referElement
 * @return A schema Element.
 */
private Element getSchemaDocument(String schemaNamespace, XMLInputSource schemaSource,
        boolean mustResolve, short referType, Element referElement) {

    boolean hasInput = true;
    IOException exception = null;
    // contents of this method will depend on the system we adopt for entity resolution--i.e., XMLEntityHandler, EntityHandler, etc.
    Element schemaElement = null;
    try {
        // when the system id and byte stream and character stream
        // of the input source are all null, it's
        // impossible to find the schema document. so we skip in
        // this case. otherwise we'll receive some NPE or
        // file not found errors. but schemaHint=="" is perfectly
        // legal for import.
        if (schemaSource != null &&
                (schemaSource.getSystemId() != null ||
                        schemaSource.getByteStream() != null ||
                        schemaSource.getCharacterStream() != null)) {

            // When the system id of the input source is used, first try to
            // expand it, and check whether the same document has been
            // parsed before. If so, return the document corresponding to
            // that system id.
            XSDKey key = null;
            String schemaId = null;
            if (referType != XSDDescription.CONTEXT_PREPARSE){
                schemaId = XMLEntityManager.expandSystemId(schemaSource.getSystemId(), schemaSource.getBaseSystemId(), false);
                key = new XSDKey(schemaId, referType, schemaNamespace);
                if((schemaElement = fTraversed.get(key)) != null) {
                    fLastSchemaWasDuplicate = true;
                    return schemaElement;
                }
                if ((!schemaSource.isCreatedByResolver()) &&
                        (referType == XSDDescription.CONTEXT_IMPORT || referType == XSDDescription.CONTEXT_INCLUDE
                        || referType == XSDDescription.CONTEXT_REDEFINE)) {
                    String accessError = SecuritySupport.checkAccess(schemaId, fAccessExternalSchema, Constants.ACCESS_EXTERNAL_ALL);
                    if (accessError != null) {
                        reportSchemaFatalError("schema_reference.access",
                                new Object[] { SecuritySupport.sanitizePath(schemaId), accessError },
                                referElement);
                    }
                }
            }

            fSchemaParser.parse(schemaSource);
            Document schemaDocument = fSchemaParser.getDocument();
            schemaElement = schemaDocument != null ? DOMUtil.getRoot(schemaDocument) : null;
            return getSchemaDocument0(key, schemaId, schemaElement);
        }
        else {
            hasInput = false;
        }
    }
    catch (IOException ex) {
        exception = ex;
    }
    return getSchemaDocument1(mustResolve, hasInput, schemaSource, referElement, exception);
}
 

import com.sun.org.apache.xerces.internal.utils.SecuritySupport; //导入方法依赖的package包/类
/**
 * getSchemaDocument method uses XMLInputSource to parse a schema document.
 * @param schemaNamespace
 * @param schemaSource
 * @param mustResolve
 * @param referType
 * @param referElement
 * @return A schema Element.
 */
private Element getSchemaDocument(String schemaNamespace, XMLInputSource schemaSource,
        boolean mustResolve, short referType, Element referElement) {

    boolean hasInput = true;
    IOException exception = null;
    // contents of this method will depend on the system we adopt for entity resolution--i.e., XMLEntityHandler, EntityHandler, etc.
    Element schemaElement = null;
    try {
        // when the system id and byte stream and character stream
        // of the input source are all null, it's
        // impossible to find the schema document. so we skip in
        // this case. otherwise we'll receive some NPE or
        // file not found errors. but schemaHint=="" is perfectly
        // legal for import.
        if (schemaSource != null &&
                (schemaSource.getSystemId() != null ||
                        schemaSource.getByteStream() != null ||
                        schemaSource.getCharacterStream() != null)) {

            // When the system id of the input source is used, first try to
            // expand it, and check whether the same document has been
            // parsed before. If so, return the document corresponding to
            // that system id.
            XSDKey key = null;
            String schemaId = null;
            if (referType != XSDDescription.CONTEXT_PREPARSE){
                schemaId = XMLEntityManager.expandSystemId(schemaSource.getSystemId(), schemaSource.getBaseSystemId(), false);
                key = new XSDKey(schemaId, referType, schemaNamespace);
                if((schemaElement = fTraversed.get(key)) != null) {
                    fLastSchemaWasDuplicate = true;
                    return schemaElement;
                }
                if (referType == XSDDescription.CONTEXT_IMPORT || referType == XSDDescription.CONTEXT_INCLUDE
                        || referType == XSDDescription.CONTEXT_REDEFINE) {
                    String accessError = SecuritySupport.checkAccess(schemaId, fAccessExternalSchema, Constants.ACCESS_EXTERNAL_ALL);
                    if (accessError != null) {
                        reportSchemaFatalError("schema_reference.access",
                                new Object[] { SecuritySupport.sanitizePath(schemaId), accessError },
                                referElement);
                    }
                }
            }

            fSchemaParser.parse(schemaSource);
            Document schemaDocument = fSchemaParser.getDocument();
            schemaElement = schemaDocument != null ? DOMUtil.getRoot(schemaDocument) : null;
            return getSchemaDocument0(key, schemaId, schemaElement);
        }
        else {
            hasInput = false;
        }
    }
    catch (IOException ex) {
        exception = ex;
    }
    return getSchemaDocument1(mustResolve, hasInput, schemaSource, referElement, exception);
}
 

import com.sun.org.apache.xerces.internal.utils.SecuritySupport; //导入方法依赖的package包/类
/**
 * Check the protocol used in the systemId against allowed protocols
 *
 * @param systemId the Id of the URI
 * @param allowedProtocols a list of allowed protocols separated by comma
 * @return the name of the protocol if rejected, null otherwise
 */
String checkAccess(String systemId, String allowedProtocols) throws IOException {
    String baseSystemId = fEntityScanner.getBaseSystemId();
    String expandedSystemId = fEntityManager.expandSystemId(systemId, baseSystemId,fStrictURI);
    return SecuritySupport.checkAccess(expandedSystemId, allowedProtocols, Constants.ACCESS_EXTERNAL_ALL);
}
 

import com.sun.org.apache.xerces.internal.utils.SecuritySupport; //导入方法依赖的package包/类
/**
 * Check the protocol used in the systemId against allowed protocols
 *
 * @param systemId the Id of the URI
 * @param allowedProtocols a list of allowed protocols separated by comma
 * @return the name of the protocol if rejected, null otherwise
 */
String checkAccess(String systemId, String allowedProtocols) throws IOException {
    String baseSystemId = fEntityScanner.getBaseSystemId();
    String expandedSystemId = XMLEntityManager.expandSystemId(systemId, baseSystemId, fStrictURI);
    return SecuritySupport.checkAccess(expandedSystemId, allowedProtocols, Constants.ACCESS_EXTERNAL_ALL);
}