如何防止功能 FEATURE_SECURE_PROCESSING 设置为 true 的 TransformerFactory 剥离属性？

问题描述 投票：0回答：1

我有 2 个 

TransformerFactory
实例：一个是默认实例，一个具有安全处理功能集 
true
。每个都为同一个 XSL 文件生成一个 
Templates
。当我对每个 XML 数据进行转换时，我收到不同的结果。

从安全

TransformerFactory
生成的输出从我的元素中剥离了属性。
控制台输出已识别：
SystemId Unknown; Line #xx; Column #yy; "zzzz" attribute is not allowed on the vvvv element!

这是怎么回事，我该如何防止这种情况？

今后我需要将安全处理设置为 true。请注意，如果我使用 

xsl:attribute
标签 (
<xsl:attribute name="variable">value</xsl:attribute>
) 应用该属性，那么转换不会忽略它，但是我有许多比示例大得多的 XSL 文件，并且更改它需要付出巨大的努力。 必须有一个设置允许安全处理，但也允许严格的属性。

研究部分

  • 类似的问题未得到解答，因为它与对 Apache-FO 的关注而不是实际问题（即安全转换器）混为一谈。

  • 根据这个问题，这可能是 xalan-2.7.1/xalan-2.7.2 库的问题；我将研究并更新依赖项。

数据部分

示例代码

package test;

import java.io.File;
import java.io.StringReader;
import java.io.StringWriter;
import java.nio.charset.Charset;

import javax.xml.transform.Templates;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.stream.StreamResult;
import javax.xml.transform.stream.StreamSource;

import org.apache.commons.io.FileUtils;

public class XformTest {

    public static void main(String[] args) {
        
        try {

            File BASE_FOLDER = new File("C:\\path-to-work-folder\\");
                
            File outFolder = new File(BASE_FOLDER, "out_" + System.currentTimeMillis());
            outFolder.mkdirs();

            String xmlData = FileUtils.readFileToString(new File(BASE_FOLDER, "data.xml"), Charset.defaultCharset());
            File xslFile = new File(BASE_FOLDER, "format.xsl");
            
            StreamSource dataSource = null;
            StreamSource xslSource = null;
            TransformerFactory factory = null;
            Templates template = null;
            Transformer transformer = null;
            StringWriter writer = null;
            File outFile = null;
            String result = null;
            
            // DEFAULT
            System.out.println("DEFAULT");
            outFile = new File(outFolder, "default.html");
            dataSource = new StreamSource(new StringReader(xmlData));
            xslSource = new StreamSource(FileUtils.openInputStream(xslFile));
            factory = TransformerFactory.newInstance();
            template = factory.newTemplates(xslSource);
            transformer = template.newTransformer();
            writer = new StringWriter();
            transformer.transform(dataSource, new StreamResult(writer));
            result = writer.toString();
            FileUtils.writeStringToFile(outFile, result, Charset.defaultCharset());
            
            // SECURE
            System.out.println("SECURE");
            outFile = new File(outFolder, "secure.html");
            dataSource = new StreamSource(new StringReader(xmlData));
            xslSource = new StreamSource(FileUtils.openInputStream(xslFile));
            factory = TransformerFactory.newInstance();
            factory.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
            template = factory.newTemplates(xslSource);
            transformer = template.newTransformer();
            writer = new StringWriter();
            transformer.transform(dataSource, new StreamResult(writer));
            result = writer.toString();
            FileUtils.writeStringToFile(outFile, result, Charset.defaultCharset());
            
        } catch (Exception ex) {
            ex.printStackTrace();
        }
    }     
}

数据文件“data.xml”

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<page>
    <record>
    <data>0</data>
    <moredata>888.88</moredata>
    <info>12345</info>
    <name>foo</name>
    </record>
    <Address1>123 ANY STREET</Address1>
    <Address2>SUITE 100</Address2>
    <City>ALBUQUERQUE</City>
    <Country>USA</Country>
    <Fax>1-(888)-686-8281</Fax>
    <Name>MISC 000000AA000CDDE</Name>
    <State>NM</State>
    <Zip>99999-999</Zip>
</page>

XSL 文件 format.xsl

<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:output method="xml" indent="yes" encoding="UTF-8"/>
<xsl:template match="/">
<xsl:variable name="record" select="page/record"/>
<html>
<body>
<form>
<input type="hidden" name="hiddenInputName" value="SpecialValue"/>
<table width="100%" border="0">
<tr><td width="100%"><center><span class="Heading">HELP ME FIGURE THIS OUT</span></center><br/>DATA: <xsl:value-of select="page/City"/></td></tr>
<tr><td width="100%"><span class="BodyNormal"><b><i>The span should have said BodyNormal 100% and the hidden input should have a name and value of hiddenInputName and SpecialValue respectively</i></b></span></td></tr>
</table>
</form>
</body>
</html>
</xsl:template>
</xsl:stylesheet>

默认（预期）输出：“default.html”

<?xml version="1.0" encoding="UTF-8"?><html>
<body>
<form>
<input value="SpecialValue" name="hiddenInputName" type="hidden"/>
<table border="0" width="100%">
<tr>
<td width="100%">
<center>
<span class="Heading">HELP ME FIGURE THIS OUT</span>
</center>
<br/>DATA: ALBUQUERQUE</td>
</tr>
<tr>
<td width="100%">
<span class="BodyNormal">
<b>
<i>The span should have said BodyNormal 100% and the hidden input should have a name and value of hiddenInputName and SpecialValue respectively</i>
</b>
</span>
</td>
</tr>
</table>
</form>
</body>
</html>

安全（截断）输出：“secure.html”

<?xml version="1.0" encoding="UTF-8"?><html>
<body>
<form>
<input/>
<table>
<tr>
<td>
<center>
<span>HELP ME FIGURE THIS OUT</span>
</center>
<br/>DATA: ALBUQUERQUE</td>
</tr>
<tr>
<td>
<span>
<b>
<i>The span should have said BodyNormal 100% and the hidden input should have a name and value of hiddenInputName and SpecialValue respectively</i>
</b>
</span>
</td>
</tr>
</table>
</form>
</body>
</html>

控制台输出

DEFAULT
SECURE
SystemId Unknown; Line #9; Column #67; "type" attribute is not allowed on the input element!
SystemId Unknown; Line #9; Column #67; "name" attribute is not allowed on the input element!
SystemId Unknown; Line #9; Column #67; "value" attribute is not allowed on the input element!
SystemId Unknown; Line #10; Column #32; "width" attribute is not allowed on the table element!
SystemId Unknown; Line #10; Column #32; "border" attribute is not allowed on the table element!
SystemId Unknown; Line #11; Column #22; "width" attribute is not allowed on the td element!
SystemId Unknown; Line #11; Column #52; "class" attribute is not allowed on the span element!
SystemId Unknown; Line #12; Column #22; "width" attribute is not allowed on the td element!
SystemId Unknown; Line #12; Column #47; "class" attribute is not allowed on the span element!
java xslt
1个回答
1
投票

解决了。

这是由于 xalan-2.7.2。 这是 Xalan-J、XALANJ-2591 的 JIRA 错误。

切换到 xalan-2.7.1 解决了问题，但我最终暂时转移到 Apache ServiceMix xalan build 2.7.2_3，它有一个针对该错误的嵌入式补丁。

此补丁未迁移到后续的 Apache xalan-2.7.3 版本；该错误仍然存在。此外，xalan-2.7.3 的 ServiceMix 的早期版本与之前的 ServiceMix 版本不一致，直到我目前正在使用的 ServiceMix xalan-2.7.3_3 并解决了所有问题。

这是 Xalan 2.7.3_3 的 Apache ServiceMix 的 Maven 包含文件

<!-- https://mvnrepository.com/artifact/org.apache.servicemix.bundles/org.apache.servicemix.bundles.xalan -->
<dependency>
    <groupId>org.apache.servicemix.bundles</groupId>
    <artifactId>org.apache.servicemix.bundles.xalan</artifactId>
    <version>2.7.3_3</version>
</dependency>
最新问题
© www.soinside.com 2019 - 2024. All rights reserved.