Sonar问题，用于使用XSD文件验证XML的访问权限

Question

我正在使用XSD验证XML文件，并且我正在为Schemafactory对象创建声纳问题 XML解析器不应容易受到XXE攻击的攻击，因此我设置了以下属性

schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");

，但是当我运行代码时，我将获得http：//javax.xml.xml.xml.xml.constants/property/ AccessExternalDTD未被识别。 错误，请帮助我找出问题。

SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);

    schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
    schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
    try {
        Schema schema = schemaFactory.newSchema(new File(getResource(schemaFile)));

        Validator validator = schema.newValidator();
        validator.validate(new StreamSource(new File(getResource(xmlFile))));
        return true;
    } catch (SAXException | IOException e) {
        xsdInvalidData.add(xmlFile + "=" + e.getMessage());
        logger.error(xmlFile + "invalid xsd and enter in catch " + e.getMessage());
        return false;
    }

Answer 1

默认javax.xml.validation.schemafactory不支持任何东西。您可能需要找到不同的实现。

public void setProperty(String name, Object object)
    throws SAXNotRecognizedException, SAXNotSupportedException {

    if (name == null) {
            throw new NullPointerException("the name parameter is null");
    }
    throw new SAXNotRecognizedException(name);
}