Revert "Revert "Revert "Configure parser factories to prevent XXE att…

…acks - 4thlineGH-9"""

This reverts commit 29e6e56.

and revert again since we need sax to list files

xml/src/main/java/org/seamless/xml/DOMParser.java

@@ -136,15 +136,6 @@ public DocumentBuilderFactory createFactory(boolean validating) throws ParserExc
                 factory.setFeature("http://apache.org/xml/features/xinclude/fixup-base-uris", false);
                 factory.setFeature("http://apache.org/xml/features/xinclude/fixup-language", false);
 
-                // Configure parser to prevent XXE attacks
-                factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-                factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
-                factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-                factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
-                factory.setXIncludeAware(false);
-                factory.setExpandEntityReferences(false);
-
-
                 // Good idea to set a schema when you want to validate! Tell me, how does it work
                 // without a schema?!
                 factory.setSchema(getSchema());

xml/src/main/java/org/seamless/xml/SAXParser.java

@@ -65,23 +65,16 @@ public void setContentHandler(ContentHandler handler) {
 
     protected XMLReader create() {
         try {
-            SAXParserFactory factory = SAXParserFactory.newInstance();
-
-            // Configure factory to prevent XXE attacks
-            factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
-            factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-            factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-            factory.setXIncludeAware(false);
-
-            factory.setNamespaceAware(true);
-
             if (getSchemaSources() != null) {
+                // Jump through all the hoops and create a validating reader
+                SAXParserFactory factory = SAXParserFactory.newInstance();
+                factory.setNamespaceAware(true);
                 factory.setSchema(createSchema(getSchemaSources()));
+                XMLReader xmlReader = factory.newSAXParser().getXMLReader();
+                xmlReader.setErrorHandler(getErrorHandler());
+                return xmlReader;
             }
-
-            XMLReader xmlReader = factory.newSAXParser().getXMLReader();
-            xmlReader.setErrorHandler(getErrorHandler());
-            return xmlReader;
+            return XMLReaderFactory.createXMLReader();
         } catch (Exception ex) {
             throw new RuntimeException(ex);
         }