响应中的XML数据注入来自Web服务的XML

Question

我需要修复以下用于XML数据注入的代码。

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); 
DocumentBuilder db = factory.newDocumentBuilder(); 
InputSource inStream = new InputSource(); 
inStream.setCharacterStream(new StringReader(xmlFromWebService)); 
Document doc = db.parse(inStream); // reported at this line by a code audit tool 
doc.getDocumentElement().normalize(); 

如何解决？有没有人有任何建议。

Answer 1

我猜测这与你的XML对一个给定的XSD的验证有关，以防止XML数据注入。我建议你这样修改你的代码：

try { 
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); 
    factory.setNamespaceAware(true); 
    factory.setValidating(true); 

    factory.setProperty("http://java.sun.com/xml/jaxp/properties/schemaLanguage", 
         "http://www.w3.org/2001/XMLSchema"); 
    factory.setProperty("http://java.sun.com/xml/jaxp/properties/schemaSource", 
         "file:<your_xsd_file>"); 

    DocumentBuilder builder = factory.newDocumentBuilder(); 
    InputSource inStream = new InputSource(); 
    inStream.setCharacterStream(new StringReader(xmlFromWebService)); 
    Document document = builder.parse(inStream); 

} catch (ParserConfigurationException e) { 
    e.printStackTrace(); 
} catch (SAXException e) { 
    e.printStackTrace(); 
} catch (IOException e) { 
    e.printStackTrace(); 
} 

我希望你能得到提示！