package manage.validations;

import org.everit.json.schema.FormatValidator;
import org.xml.sax.SAXException;

import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.util.Optional;

public class XMLFormatValidator implements FormatValidator {

    @Override
    public Optional<String> validate(String subject) {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        factory.setValidating(false);
        factory.setNamespaceAware(true);
        try {
            factory.newDocumentBuilder().parse(new ByteArrayInputStream(subject.getBytes()));
        } catch (ParserConfigurationException | SAXException | IOException e) {
            return Optional.of(e.toString());
        }
        return Optional.empty();
    }

    @Override
    public String formatName() {
        return "xml";
    }

}

@@ -103,16 +103,47 @@
 ption;%0A%0A
+import javax.xml.XMLConstants;%0A
 import j
@@ -183,16 +183,16 @@
 actory;%0A
-
 import j
@@ -393,16 +393,131 @@
 ator %7B%0A%0A
+    private static final String FEATURE_DISABLE_DOCTYPE = %22http://apache.org/xml/features/disallow-doctype-decl%22;%0A%0A
     @Ove
@@ -731,24 +731,24 @@
 ware(true);%0A
-
         try 
@@ -749,16 +749,157 @@
   try %7B%0A
+            factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);%0A            factory.setFeature(FEATURE_DISABLE_DOCTYPE, true);%0A
         

Resolve XXE vulnerability in XML validation