英文:
Passing XML Parser features to Saxon for stylesheet parsing
问题
在Saxon API中，可以使用XML_PARSER_FEATURE配置功能将XML解析器特性传递给Configuration对象。
但似乎这仅适用于源文档的解析，而不适用于XSLT样式表的解析。是否有一种方法来配置样式表的解析，而不是插入自定义解析器？
具体而言，出于安全原因，我需要确保外部实体已禁用。
英文:
In the Saxon API, it is possible to pass XML parser features to the Configuration object using the XML_PARSER_FEATURE Config feature.
But it seems this is only applied to the parsing of the source document, and not of the XSLT stylesheet. Is there a way to configure stylesheet parsing as well, other than plugging in a custom parser?
Concretely, I need to make sure external entities are disabled for security reasons.
答案1
得分: 1
首先，请注意，如果您不信任样式表，它可以造成的损害远不止使用外部实体。因此，禁用外部实体只是您需要采取的步骤之一，其中最重要的步骤之一是禁用反射扩展函数的使用。
配置解析样式表模块的最佳方式是自己创建它。对于主样式表模块，请提供一个包含按您所需配置的 XMLReader 的 SAXSource。对于包含和导入的模块，请使用一个分配 XMLReader 并返回 SAXSource 的 URIResolver。
还有一个配置选项 Feature.STYLE_PARSER_CLASS。您可以使用此选项来实现自己的类，该类实现了 XMLReader 接口，并将实际解析委托给一个您完全控制的“真实” XMLReader。
英文:
First, note that if you don't trust the stylesheet, there are many, many ways it can do damage other than using external entities. So disabling external entities is only one of the steps you need to take: the most important of which is to disable use of reflexive extension functions.
The best way to configure the parser for processing stylesheet modules is to create it yourself. For the main stylesheet module, supply a SAXSource containing an XMLReader configured the way you want it. For included and imported modules, use a URIResolver that allocates an XMLReader and returns a SAXSource.
There's also a configuration option Feature.STYLE_PARSER_CLASS. You can use this to implement your own class that implements the XMLReader interface, delegating the actual parsing to a "real" XMLReader over which you have full control.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论