class IgnoreDTDEntityResolver implements EntityResolver
{
public InputSource resolveEntity(String publicId, String systemId) throws SAXException, IOException {
return new InputSource(new ByteArrayInputStream(
"<?xml version='1.0' encoding='UTF-8'?>".getBytes()));
}
}
SAXReader saxReader = new SAXReader();
saxReader.setValidation(false);
try {
saxReader.setEntityResolver(new IgnoreDTDEntityResolver());
document = saxReader.read(file);
} catch (DocumentException e) {
e.printStackTrace();
}
本文介绍了一种禁用XML解析中DTD实体解析的方法,通过自定义解析器`IgnoreDTDEntityResolver`来避免外部实体加载,这对于防止潜在的安全威胁如XML外部实体注入攻击尤为重要。
3514

被折叠的 条评论
为什么被折叠?



