public class RemoveDoctypeInputStream
extends java.io.FileInputStream
FileInputStream.
It assumes that the given file is an XML document.
Its various read() methods work the same as the corresponding methods
in FileInputStream, except that they strip out the <!DOCTYPE ... > tag.
To properly secure the XML parser against XXE (XML eXternal Entity) injection,
we have to disallow DTD declarations.
Doing it this way allows us to parse the XML without requiring the customer
to edit it or reconfigure whatever program generates it.| Constructor and Description |
|---|
RemoveDoctypeInputStream(java.lang.String file)
Constructor
|
| Modifier and Type | Method and Description |
|---|---|
void |
mark(int limit) |
boolean |
markSupported() |
int |
read()
Implements
InputStream.read(), but strips out the DOCTYPE tag from the input. |
int |
read(byte[] b)
Implements
InputStream.read(byte[]), but strips out the DOCTYPE tag from the input. |
int |
read(byte[] b,
int offset,
int len)
Implements
InputStream.read(byte[], int, int), but strips out the DOCTYPE tag from the input. |
void |
reset() |
public RemoveDoctypeInputStream(java.lang.String file)
throws java.io.IOException
file - java.io.IOExceptionpublic int read()
throws java.io.IOException
InputStream.read(), but strips out the DOCTYPE tag from the input.read in class java.io.FileInputStreamjava.io.IOExceptionpublic int read(byte[] b)
throws java.io.IOException
InputStream.read(byte[]), but strips out the DOCTYPE tag from the input.read in class java.io.FileInputStreamjava.io.IOExceptionpublic int read(byte[] b,
int offset,
int len)
throws java.io.IOException
InputStream.read(byte[], int, int), but strips out the DOCTYPE tag from the input.read in class java.io.FileInputStreamjava.io.IOExceptionpublic boolean markSupported()
markSupported in class java.io.InputStreampublic void mark(int limit)
mark in class java.io.InputStreampublic void reset()
reset in class java.io.InputStream