* Return a new factory so that the caller can set sticky parameters.
* @param nsAware
* @throws XMLStreamException
*/
public static XMLInputFactory createXMLInputFactory(boolean nsAware) {
XMLInputFactory factory = null;
try {
factory = XMLInputFactory.newInstance();
} catch (Throwable t) {
factory = null;
}
if (factory == null || !setRestrictionProperties(factory)) {
try {
factory = createWoodstoxFactory();
} catch (Throwable t) {
//ignore for now
}
if (!setRestrictionProperties(factory)) {
if (allowInsecureParser) {
LOG.log(Level.WARNING, "INSECURE_PARSER_DETECTED", factory.getClass().getName());
} else {
throw new RuntimeException("Cannot create a secure XMLInputFactory");
}
}
}
setProperty(factory, XMLInputFactory.IS_NAMESPACE_AWARE, nsAware);
setProperty(factory, XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
setProperty(factory, XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.FALSE);
setProperty(factory, XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
factory.setXMLResolver(new XMLResolver() {
public Object resolveEntity(String publicID, String systemID,
String baseURI, String namespace)
throws XMLStreamException {
throw new XMLStreamException("Reading external entities is disabled");
}