/*
 * Copyright (C) 2004-2011
 * 
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
package org.kohsuke.rngom.xml.sax;

import javax.xml.parsers.ParserConfigurationException;
import javax.xml.parsers.SAXParserFactory;

import org.xml.sax.SAXException;
import org.xml.sax.XMLReader;

/**
 * {@link XMLReaderCreator} that uses JAXP to create
 * {@link XMLReader}s.
 * 
 * @author
 *      Kohsuke Kawaguchi (kk@kohsuke.org)
 */
public class JAXPXMLReaderCreator implements XMLReaderCreator {

    private final SAXParserFactory spf;
    
    public JAXPXMLReaderCreator( SAXParserFactory spf ) {
        this.spf = spf;
    }
    
    /**
     * Creates a {@link JAXPXMLReaderCreator} by using
     * {@link SAXParserFactory#newInstance()}.
     */
    public JAXPXMLReaderCreator() {
        spf = SAXParserFactory.newInstance();
        spf.setNamespaceAware(true);
    }
    
    /**
     * @see org.kohsuke.rngom.xml.sax.XMLReaderCreator#createXMLReader()
     */
    public XMLReader createXMLReader() throws SAXException {
        try {
            return spf.newSAXParser().getXMLReader();
        } catch (ParserConfigurationException e) {
            throw new SAXException(e);
        }
    }

}

@@ -21,17 +21,17 @@
 2004-201
-1
+2
 %0A * %0A * 
@@ -1139,16 +1139,112 @@
 l.sax;%0A%0A
+import java.util.logging.Level;%0Aimport java.util.logging.Logger;%0Aimport javax.xml.XMLConstants;%0A
 import j
@@ -1363,24 +1363,115 @@
 XException;%0A
+import org.xml.sax.SAXNotRecognizedException;%0Aimport org.xml.sax.SAXNotSupportedException;%0A
 import org.x
@@ -2030,24 +2030,24 @@
 Instance();%0A
-
         spf.
@@ -2067,24 +2067,559 @@
 ware(true);%0A
+        try %7B%0A            spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);%0A        %7D catch (ParserConfigurationException ex) %7B%0A            Logger.getLogger(JAXPXMLReaderCreator.class.getName()).log(Level.SEVERE, null, ex);%0A        %7D catch (SAXNotRecognizedException ex) %7B%0A            Logger.getLogger(JAXPXMLReaderCreator.class.getName()).log(Level.SEVERE, null, ex);%0A        %7D catch (SAXNotSupportedException ex) %7B%0A            Logger.getLogger(JAXPXMLReaderCreator.class.getName()).log(Level.SEVERE, null, ex);%0A        %7D%0A
     %7D%0A    %0A 

use secure feat. processing by default