* </p>
*
* @return a new parser pool instance
*/
protected ParserPool buildParserPool() {
StaticBasicParserPool pp = new StaticBasicParserPool();
HashMap<String, Boolean> features = new HashMap<String, Boolean>();
pp.setNamespaceAware(true);
// Note: this feature config is necessary due to an unresolved Xerces deferred DOM issue/bug
features.put("http://apache.org/xml/features/dom/defer-node-expansion", Boolean.FALSE);
// The following config is to harden the parser pool against known XML security vulnerabilities
pp.setExpandEntityReferences(false);
features.put(XMLConstants.FEATURE_SECURE_PROCESSING, true);
features.put("http://apache.org/xml/features/disallow-doctype-decl", true);
pp.setBuilderFeatures(features);
try {
pp.initialize();
return pp;
} catch (XMLParserException e) {
throw new XMLRuntimeException("Problem initializing Decrypter internal ParserPool", e);
}
}