11/*
2- * Copyright (c) 2013, 2017 , Oracle and/or its affiliates. All rights reserved.
2+ * Copyright (c) 2013, 2021 , Oracle and/or its affiliates. All rights reserved.
33 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44 *
55 * This code is free software; you can redistribute it and/or modify it
2525
2626package com .sun .org .apache .xalan .internal .utils ;
2727
28- import com .sun .org .apache .xalan .internal .XalanConstants ;
2928import java .util .concurrent .CopyOnWriteArrayList ;
29+ import jdk .xml .internal .JdkConstants ;
30+ import jdk .xml .internal .JdkProperty .ImplPropMap ;
31+ import jdk .xml .internal .JdkProperty .State ;
3032import jdk .xml .internal .SecuritySupport ;
3133import org .xml .sax .SAXException ;
3234
4143 */
4244public final class XMLSecurityManager {
4345
44- /**
45- * States of the settings of a property, in the order: default value, value
46- * set by FEATURE_SECURE_PROCESSING, jaxp.properties file, jaxp system
47- * properties, and jaxp api properties
48- */
49- public static enum State {
50- //this order reflects the overriding order
51-
52- DEFAULT ("default" ), FSP ("FEATURE_SECURE_PROCESSING" ),
53- JAXPDOTPROPERTIES ("jaxp.properties" ), SYSTEMPROPERTY ("system property" ),
54- APIPROPERTY ("property" );
55-
56- final String literal ;
57- State (String literal ) {
58- this .literal = literal ;
59- }
60-
61- String literal () {
62- return literal ;
63- }
64- }
65-
6646 /**
6747 * Limits managed by the security manager
6848 */
49+ @ SuppressWarnings ("deprecation" )
6950 public static enum Limit {
7051
71- ENTITY_EXPANSION_LIMIT ("EntityExpansionLimit" , XalanConstants .JDK_ENTITY_EXPANSION_LIMIT ,
72- XalanConstants .SP_ENTITY_EXPANSION_LIMIT , 0 , 64000 ),
73- MAX_OCCUR_NODE_LIMIT ("MaxOccurLimit" , XalanConstants .JDK_MAX_OCCUR_LIMIT ,
74- XalanConstants .SP_MAX_OCCUR_LIMIT , 0 , 5000 ),
75- ELEMENT_ATTRIBUTE_LIMIT ("ElementAttributeLimit" , XalanConstants .JDK_ELEMENT_ATTRIBUTE_LIMIT ,
76- XalanConstants .SP_ELEMENT_ATTRIBUTE_LIMIT , 0 , 10000 ),
77- TOTAL_ENTITY_SIZE_LIMIT ("TotalEntitySizeLimit" , XalanConstants .JDK_TOTAL_ENTITY_SIZE_LIMIT ,
78- XalanConstants .SP_TOTAL_ENTITY_SIZE_LIMIT , 0 , 50000000 ),
79- GENERAL_ENTITY_SIZE_LIMIT ("MaxEntitySizeLimit" , XalanConstants .JDK_GENERAL_ENTITY_SIZE_LIMIT ,
80- XalanConstants .SP_GENERAL_ENTITY_SIZE_LIMIT , 0 , 0 ),
81- PARAMETER_ENTITY_SIZE_LIMIT ("MaxEntitySizeLimit" , XalanConstants .JDK_PARAMETER_ENTITY_SIZE_LIMIT ,
82- XalanConstants .SP_PARAMETER_ENTITY_SIZE_LIMIT , 0 , 1000000 ),
83- MAX_ELEMENT_DEPTH_LIMIT ("MaxElementDepthLimit" , XalanConstants .JDK_MAX_ELEMENT_DEPTH ,
84- XalanConstants .SP_MAX_ELEMENT_DEPTH , 0 , 0 ),
85- MAX_NAME_LIMIT ("MaxXMLNameLimit" , XalanConstants .JDK_XML_NAME_LIMIT ,
86- XalanConstants .SP_XML_NAME_LIMIT , 1000 , 1000 ),
87- ENTITY_REPLACEMENT_LIMIT ("EntityReplacementLimit" , XalanConstants .JDK_ENTITY_REPLACEMENT_LIMIT ,
88- XalanConstants .SP_ENTITY_REPLACEMENT_LIMIT , 0 , 3000000 );
52+ ENTITY_EXPANSION_LIMIT ("EntityExpansionLimit" , JdkConstants .JDK_ENTITY_EXPANSION_LIMIT ,
53+ JdkConstants .SP_ENTITY_EXPANSION_LIMIT , 0 , 64000 ),
54+ MAX_OCCUR_NODE_LIMIT ("MaxOccurLimit" , JdkConstants .JDK_MAX_OCCUR_LIMIT ,
55+ JdkConstants .SP_MAX_OCCUR_LIMIT , 0 , 5000 ),
56+ ELEMENT_ATTRIBUTE_LIMIT ("ElementAttributeLimit" , JdkConstants .JDK_ELEMENT_ATTRIBUTE_LIMIT ,
57+ JdkConstants .SP_ELEMENT_ATTRIBUTE_LIMIT , 0 , 10000 ),
58+ TOTAL_ENTITY_SIZE_LIMIT ("TotalEntitySizeLimit" , JdkConstants .JDK_TOTAL_ENTITY_SIZE_LIMIT ,
59+ JdkConstants .SP_TOTAL_ENTITY_SIZE_LIMIT , 0 , 50000000 ),
60+ GENERAL_ENTITY_SIZE_LIMIT ("MaxEntitySizeLimit" , JdkConstants .JDK_GENERAL_ENTITY_SIZE_LIMIT ,
61+ JdkConstants .SP_GENERAL_ENTITY_SIZE_LIMIT , 0 , 0 ),
62+ PARAMETER_ENTITY_SIZE_LIMIT ("MaxEntitySizeLimit" , JdkConstants .JDK_PARAMETER_ENTITY_SIZE_LIMIT ,
63+ JdkConstants .SP_PARAMETER_ENTITY_SIZE_LIMIT , 0 , 1000000 ),
64+ MAX_ELEMENT_DEPTH_LIMIT ("MaxElementDepthLimit" , JdkConstants .JDK_MAX_ELEMENT_DEPTH ,
65+ JdkConstants .SP_MAX_ELEMENT_DEPTH , 0 , 0 ),
66+ MAX_NAME_LIMIT ("MaxXMLNameLimit" , JdkConstants .JDK_XML_NAME_LIMIT ,
67+ JdkConstants .SP_XML_NAME_LIMIT , 1000 , 1000 ),
68+ ENTITY_REPLACEMENT_LIMIT ("EntityReplacementLimit" , JdkConstants .JDK_ENTITY_REPLACEMENT_LIMIT ,
69+ JdkConstants .SP_ENTITY_REPLACEMENT_LIMIT , 0 , 3000000 );
8970
9071 final String key ;
9172 final String apiProperty ;
@@ -101,12 +82,36 @@ public static enum Limit {
10182 this .secureValue = secureValue ;
10283 }
10384
104- public boolean equalsAPIPropertyName (String propertyName ) {
105- return (propertyName == null ) ? false : apiProperty .equals (propertyName );
85+ /**
86+ * Checks whether the specified name is a limit. Checks both the
87+ * property and System Property which is now the new property name.
88+ *
89+ * @param name the specified name
90+ * @return true if there is a match, false otherwise
91+ */
92+ public boolean is (String name ) {
93+ // current spec: new property name == systemProperty
94+ return (systemProperty != null && systemProperty .equals (name )) ||
95+ // current spec: apiProperty is legacy
96+ (apiProperty .equals (name ));
10697 }
10798
108- public boolean equalsSystemPropertyName (String propertyName ) {
109- return (propertyName == null ) ? false : systemProperty .equals (propertyName );
99+ /**
100+ * Returns the state of a property name. By the specification as of JDK 17,
101+ * the "jdk.xml." prefixed System property name is also the current API
102+ * name. The URI-based qName is legacy.
103+ *
104+ * @param name the property name
105+ * @return the state of the property name, null if no match
106+ */
107+ public State getState (String name ) {
108+ if (systemProperty != null && systemProperty .equals (name )) {
109+ return State .APIPROPERTY ;
110+ } else if (apiProperty .equals (name )) {
111+ //the URI-style qName is legacy
112+ return State .LEGACY_APIPROPERTY ;
113+ }
114+ return null ;
110115 }
111116
112117 public String key () {
@@ -117,7 +122,7 @@ public String apiProperty() {
117122 return apiProperty ;
118123 }
119124
120- String systemProperty () {
125+ public String systemProperty () {
121126 return systemProperty ;
122127 }
123128
@@ -135,12 +140,12 @@ int secureValue() {
135140 */
136141 public static enum NameMap {
137142
138- ENTITY_EXPANSION_LIMIT (XalanConstants .SP_ENTITY_EXPANSION_LIMIT ,
139- XalanConstants .ENTITY_EXPANSION_LIMIT ),
140- MAX_OCCUR_NODE_LIMIT (XalanConstants .SP_MAX_OCCUR_LIMIT ,
141- XalanConstants .MAX_OCCUR_LIMIT ),
142- ELEMENT_ATTRIBUTE_LIMIT (XalanConstants .SP_ELEMENT_ATTRIBUTE_LIMIT ,
143- XalanConstants .ELEMENT_ATTRIBUTE_LIMIT );
143+ ENTITY_EXPANSION_LIMIT (JdkConstants .SP_ENTITY_EXPANSION_LIMIT ,
144+ JdkConstants .ENTITY_EXPANSION_LIMIT ),
145+ MAX_OCCUR_NODE_LIMIT (JdkConstants .SP_MAX_OCCUR_LIMIT ,
146+ JdkConstants .MAX_OCCUR_LIMIT ),
147+ ELEMENT_ATTRIBUTE_LIMIT (JdkConstants .SP_ELEMENT_ATTRIBUTE_LIMIT ,
148+ JdkConstants .ELEMENT_ATTRIBUTE_LIMIT );
144149 final String newName ;
145150 final String oldName ;
146151
@@ -230,7 +235,11 @@ public void setSecureProcessing(boolean secure) {
230235 public boolean setLimit (String propertyName , State state , Object value ) {
231236 int index = getIndex (propertyName );
232237 if (index > -1 ) {
233- setLimit (index , state , value );
238+ State pState = state ;
239+ if (index != indexEntityCountInfo && state == State .APIPROPERTY ) {
240+ pState = (Limit .values ()[index ]).getState (propertyName );
241+ }
242+ setLimit (index , pState , value );
234243 return true ;
235244 }
236245 return false ;
@@ -259,14 +268,17 @@ public void setLimit(int index, State state, Object value) {
259268 //if it's explicitly set, it's treated as yes no matter the value
260269 printEntityCountInfo = (String )value ;
261270 } else {
262- int temp = 0 ;
263- try {
271+ int temp ;
272+ if (value instanceof Integer ) {
273+ temp = (Integer )value ;
274+ } else {
264275 temp = Integer .parseInt ((String ) value );
265276 if (temp < 0 ) {
266277 temp = 0 ;
267278 }
268- } catch (NumberFormatException e ) {}
269- setLimit (index , state , temp ); }
279+ }
280+ setLimit (index , state , temp );
281+ }
270282 }
271283
272284 /**
@@ -279,7 +291,7 @@ public void setLimit(int index, State state, Object value) {
279291 public void setLimit (int index , State state , int value ) {
280292 if (index == indexEntityCountInfo ) {
281293 //if it's explicitly set, it's treated as yes no matter the value
282- printEntityCountInfo = XalanConstants .JDK_YES ;
294+ printEntityCountInfo = JdkConstants .JDK_YES ;
283295 } else {
284296 //only update if it shall override
285297 if (state .compareTo (states [index ]) >= 0 ) {
@@ -377,13 +389,14 @@ public String getStateLiteral(Limit limit) {
377389 */
378390 public int getIndex (String propertyName ) {
379391 for (Limit limit : Limit .values ()) {
380- if (limit .equalsAPIPropertyName (propertyName )) {
392+ // see JDK-8265248, accept both the URL and jdk.xml as prefix
393+ if (limit .is (propertyName )) {
381394 //internally, ordinal is used as index
382395 return limit .ordinal ();
383396 }
384397 }
385398 //special property to return entity count info
386- if (propertyName . equals ( XalanConstants . JDK_ENTITY_COUNT_INFO )) {
399+ if (ImplPropMap . ENTITYCOUNT . is ( propertyName )) {
387400 return indexEntityCountInfo ;
388401 }
389402 return -1 ;
@@ -399,7 +412,7 @@ public boolean isSet(int index) {
399412 }
400413
401414 public boolean printEntityCountInfo () {
402- return printEntityCountInfo .equals (XalanConstants .JDK_YES );
415+ return printEntityCountInfo .equals (JdkConstants .JDK_YES );
403416 }
404417 /**
405418 * Read from system properties, or those in jaxp.properties
0 commit comments