Class SecureTransformerFactory
TransformerFactory instances.
Beyond the three universal guarantees on org.apache.commons.xml.secure: xsl:import, xsl:include and document() URIs are not
resolved.
The guarantees govern what the transform reads, not what it writes: an output instruction like xsl:result-document still writes wherever the
stylesheet directs, so an untrusted stylesheet's output destinations must be restricted outside the library.
The guarantees apply to every parser the factory creates internally for the standard TransformerFactory entry points: stylesheet compilation
(newTemplates(Source),
newTransformer(Source)) and source-document reading at
Transformer.transform(Source, Result) time.
The href an xml-stylesheet processing instruction names is content of the document being scanned, so
getAssociatedStylesheet treats it as any other content-named reference:
install a URIResolver resolving that href to compile the stylesheet it points at. Without one the returned Source carries empty content
rather than naming the URI, so compiling it cannot fetch a stylesheet the parsed document chose.
The SAXTransformerFactory extension methods (newTransformerHandler(..), newTemplatesHandler(),
newXMLFilter(..)), if reachable by casting the returned factory, produce objects carrying the same guarantees.
This class is not itself a TransformerFactory, so it inherits none of the static JAXP factory methods. A caller therefore cannot obtain an unsecured
factory through this class by calling a method such as newDefaultInstance(). The secure factories are instances of a nested, non-public wrapper
class.
- See Also:
-
Method Summary
Modifier and TypeMethodDescriptionstatic TransformerFactoryReturns a new, secureTransformerFactoryof the system-default implementation.static TransformerFactoryReturns a new, secureTransformerFactory.static TransformerFactorynewInstance(String factoryClassName, ClassLoader classLoader) Returns a new, secureTransformerFactoryof the given implementation class.
-
Method Details
-
newDefaultInstance
Returns a new, secureTransformerFactoryof the system-default implementation.Obtained from
TransformerFactory.newDefaultInstance()where the platform provides it (Java 9 or later), and by instantiating the JDK's built-in implementation directly on Java 8.- Returns:
- A secure factory.
- Throws:
IllegalStateException- Thrown if a required secure setting cannot be applied to the underlying implementation.TransformerFactoryConfigurationError- Thrown if the running platform provides neithernewDefaultInstance()nor the JDK's built-in implementation (for example Android).
-
newInstance
Returns a new, secureTransformerFactory.- Returns:
- A secure factory.
- Throws:
IllegalStateException- Thrown if a required secure setting cannot be applied to the underlying implementation.
-
newInstance
Returns a new, secureTransformerFactoryof the given implementation class.- Parameters:
factoryClassName- The fully qualified class name of theTransformerFactoryimplementation.classLoader- The class loader used to load the factory class;nullmeans the current thread's context class loader.- Returns:
- A secure factory.
- Throws:
IllegalStateException- Thrown if a required secure setting cannot be applied to the underlying implementation.TransformerFactoryConfigurationError- Thrown iffactoryClassNameisnullor the factory class cannot be loaded or instantiated.
-