java - 为什么在设置 isSupportingExternalEntities 时出现 SAXNotRecognizedException？

Question

我在尝试在 Java 8 中设置“isSupportingExternalEntities”的属性时收到 SAXNotRecognizedException

final SchemaFactory sf = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
sf.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);

异常(exception):

org.xml.sax.SAXNotRecognizedException:无法识别属性“javax.xml.stream.isSupportingExternalEntities”。

Answer 1

我猜你对 SchemeFactory 使用了错误的属性。根据 OWASP docs你应该使用以下代码

SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
Schema schema = factory.newSchema(Source);