Class InboundXMLSec

java.lang.Object
org.apache.xml.security.stax.ext.InboundXMLSec

public class InboundXMLSec extends Object
Inbound Streaming-XML-Security An instance of this class can be retrieved over the XMLSec class
  • Field Details

    • LOG

      protected static final transient org.slf4j.Logger LOG
    • xmlInputFactory

      private static final XMLInputFactory xmlInputFactory
    • securityProperties

      private final XMLSecurityProperties securityProperties
  • Constructor Details

  • Method Details

    • processInMessage

      public XMLStreamReader processInMessage(XMLStreamReader xmlStreamReader) throws XMLStreamException
      Warning: configure your xmlStreamReader correctly. Otherwise you can create a security hole. At minimum configure the following properties: xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false); xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT, new Integer(8192));

      This method is the entry point for the incoming security-engine. Hand over the original XMLStreamReader and use the returned one for further processing
      Parameters:
      xmlStreamReader - The original XMLStreamReader
      Returns:
      A new XMLStreamReader which does transparently the security processing.
      Throws:
      XMLStreamException - thrown when a streaming error occurs
    • processInMessage

      public XMLStreamReader processInMessage(XMLStreamReader xmlStreamReader, List<SecurityEvent> requestSecurityEvents, SecurityEventListener securityEventListener) throws XMLStreamException
      Warning: configure your xmlStreamReader correctly. Otherwise you can create a security hole. At minimum configure the following properties: xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false); xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT, new Integer(8192));

      This method is the entry point for the incoming security-engine. Hand over the original XMLStreamReader and use the returned one for further processing
      Parameters:
      xmlStreamReader - The original XMLStreamReader
      requestSecurityEvents - A List of requested SecurityEvents
      securityEventListener - A SecurityEventListener to receive security-relevant events.
      Returns:
      A new XMLStreamReader which does transparently the security processing.
      Throws:
      XMLStreamException - thrown when a streaming error occurs