java - 配置 XMLConstants.html#FEATURE_SECURE_PROCESSING 时出现 XSLT 和 FOP 问题

Question

我在使用 XSLFO 和 XSLT 从 Java 对象生成 PDF 时遇到问题:

我有这个代码:

TransformerFactory.newInstance("org.apache.xalan.processor.TransformerFactoryImpl",
                    Thread.currentThread().getContextClassLoader());
templates = factory.newTemplates(new StreamSource(PdfGenerator.class.getResourceAsStream(ORDERS_XSL)));
FOUserAgent foUserAgent = fopFactory.newFOUserAgent();
Source src = getSourceForCommandList(commandeList);
try {
        Fop fop = fopFactory.newFop(MimeConstants.MIME_PDF, foUserAgent, out);

        Result res = new SAXResult(fop.getDefaultHandler());

        templates.newTransformer().transform(src, res);
    } finally {
        out.flush();
    }

我的 xslt 使用 fo 命名空间:

<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.1"
    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
    xmlns:fo="http://www.w3.org/1999/XSL/Format">



    <xsl:template match="orders">
        <fo:root xmlns:fo="http://www.w3.org/1999/XSL/Format">
            <fo:layout-master-set>
                <fo:simple-page-master master-name="simpleA4"
                    page-height="29.7cm" page-width="21cm" margin-top="2cm"
                    margin-bottom="1cm" margin-left="0.5cm" margin-right="0.5cm">
                    <fo:region-body />
                </fo:simple-page-master>
            </fo:layout-master-set>
            <xsl:apply-templates select="order" />
        </fo:root>
    </xsl:template>
    ...
    </xsl:template>
</xsl:stylesheet>

它工作正常，并使用 Apache FOP 和 XSLT 从源对象生成 PDF。

但是，当我添加此行以尊重有关安全性的最佳实践时:

factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

它中断是因为 fo 命名空间未加载，我在模板解析时收到了这些警告:

SystemId Unknown; Line #13; Column #67; "master-name" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #13; Column #67; "page-height" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #13; Column #67; "page-width" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #13; Column #67; "margin-top" attribute is not allowed on the fo:simple-page-master element!

Answer 1

问题是由于加载了 xalan TransformerFactory 实现而不是 JDK 的嵌入式实现com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl

我从依赖项中排除了 xalan :

        <exclusions>
            <exclusion>
                <artifactId>xalan</artifactId>
                <groupId>xalan</groupId>
            </exclusion>
        </exclusions>

它成功了