com.predic8.membrane.core.interceptor.xmlprotection

Class XMLProtector

java.lang.Object

com.predic8.membrane.core.interceptor.xmlprotection.XMLProtector

public class XMLProtector
extends Object

Filters XML streams, removing potentially malicious elements:

• DTDs can be removed.
• The length of element names can be limited.
• The number of attibutes per element can be limited.

If protect(InputStreamReader) returns false, an unrecoverable error has occurred (such as not-wellformed XML or an element name length exceeded the limit), the OutputStreamWriter is left at this position: It should be discarded and an error response should be returned to the requestor.

Constructor Summary

Constructors

Constructor and Description
XMLProtector(OutputStreamWriter osw, boolean removeDTD, int maxElementNameLength, int maxAttibuteCount)

Method Summary

Methods

Modifier and Type	Method and Description
boolean	protect(InputStreamReader isr)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

XMLProtector

public XMLProtector(OutputStreamWriter osw,
            boolean removeDTD,
            int maxElementNameLength,
            int maxAttibuteCount)
             throws Exception

Throws:

Exception

Method Detail

protect

public boolean protect(InputStreamReader isr)