dkpro · reckart · Nov 18, 2022 · Nov 9, 2022 · Nov 18, 2022 · Nov 18, 2022
diff --git a/dkpro-core-api-xml-asl/pom.xml b/dkpro-core-api-xml-asl/pom.xml
@@ -40,5 +40,9 @@
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-lang3</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-api</artifactId>
+    </dependency>
   </dependencies>
 </project>
diff --git a/dkpro-core-api-xml-asl/src/main/java/org/dkpro/core/api/xml/XmlParserUtils.java b/dkpro-core-api-xml-asl/src/main/java/org/dkpro/core/api/xml/XmlParserUtils.java
@@ -0,0 +1,121 @@
+/*
+ * Licensed to the Technische Universität Darmstadt under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The Technische Universität Darmstadt 
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.
+ *  
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.dkpro.core.api.xml;
+
+import static javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD;
+import static javax.xml.XMLConstants.ACCESS_EXTERNAL_STYLESHEET;
+import static javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING;
+import static javax.xml.transform.OutputKeys.INDENT;
+import static javax.xml.transform.OutputKeys.METHOD;
+import static javax.xml.transform.OutputKeys.OMIT_XML_DECLARATION;
+
+import java.io.Writer;
+import java.lang.invoke.MethodHandles;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.TransformerConfigurationException;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.sax.SAXTransformerFactory;
+import javax.xml.transform.sax.TransformerHandler;
+import javax.xml.transform.stream.StreamResult;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.xml.sax.ContentHandler;
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+
+public class XmlParserUtils
+{
+    private static final Logger LOG = LoggerFactory.getLogger(MethodHandles.lookup().lookupClass());
+
+    private static final String EXTTERNAL_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities";
+    private static final String EXTERNAL_PARAMETER_ENTITIES = "http://xml.org/sax/features/external-parameter-entities";
+    private static final String DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";
+    private static final String LOAD_EXTERNAL_DTD = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
+
+    private XmlParserUtils()
+    {
+        // No instances
+    }
+
+    public static ContentHandler makeXmlSerializer(Writer aOut)
+        throws TransformerConfigurationException
+    {
+        SAXTransformerFactory tf = newTransformerFactory();
+        TransformerHandler th = tf.newTransformerHandler();
+        th.getTransformer().setOutputProperty(OMIT_XML_DECLARATION, "yes");
+        th.getTransformer().setOutputProperty(METHOD, "xml");
+        th.getTransformer().setOutputProperty(INDENT, "no");
+        th.setResult(new StreamResult(aOut));
+        return th;
+    }
+
+    public static SAXTransformerFactory newTransformerFactory()
+        throws TransformerConfigurationException
+    {
+        TransformerFactory factory = TransformerFactory.newInstance();
+        factory.setFeature(FEATURE_SECURE_PROCESSING, true);
+        factory.setAttribute(ACCESS_EXTERNAL_DTD, "");
+        factory.setAttribute(ACCESS_EXTERNAL_STYLESHEET, "");
+        return (SAXTransformerFactory) factory;
+    }
+
+    public static SAXParserFactory newSaxParserFactory()
+        throws ParserConfigurationException, SAXNotRecognizedException, SAXNotSupportedException
+    {
+        SAXParserFactory factory = SAXParserFactory.newInstance();
+        factory.setXIncludeAware(false);
+        factory.setFeature(FEATURE_SECURE_PROCESSING, true);
+        setFeature(factory, EXTTERNAL_GENERAL_ENTITIES, false);
+        setFeature(factory, EXTERNAL_PARAMETER_ENTITIES, false);
+        setFeature(factory, DISALLOW_DOCTYPE_DECL, true);
+        setFeature(factory, LOAD_EXTERNAL_DTD, false);
+        return factory;
+    }
+
+    private static void setFeature(SAXParserFactory aFactory, String aFeature, boolean aValue)
+        throws ParserConfigurationException
+    {
+        try {
+            aFactory.setFeature(aFeature, aValue);
+        }
+        catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+            if (LOG.isTraceEnabled()) {
+                LOG.warn("Unable to set SAX parser option [{}] to [{}]", aFeature, aValue, e);
+            }
+            else {
+                LOG.warn("Unable to set SAX parser option [{}] to [{}]", aFeature, aValue);
+            }
+        }
+    }
+
+    public static SAXParser newSaxParser()
+        throws SAXNotRecognizedException, SAXNotSupportedException, ParserConfigurationException,
+        SAXException
+    {
+        SAXParser saxParser = newSaxParserFactory().newSAXParser();
+        saxParser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        saxParser.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+        return saxParser;
+    }
+}
diff --git a/dkpro-core-io-ancora-asl/pom.xml b/dkpro-core-io-ancora-asl/pom.xml
@@ -36,10 +36,6 @@
       <groupId>org.apache.uima</groupId>
       <artifactId>uimafit-core</artifactId>
     </dependency>
-    <dependency>
-      <groupId>commons-io</groupId>
-      <artifactId>commons-io</artifactId>
-    </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-api</artifactId>
@@ -48,6 +44,10 @@
       <groupId>org.dkpro.core</groupId>
       <artifactId>dkpro-core-api-io-asl</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.dkpro.core</groupId>
+      <artifactId>dkpro-core-api-xml-asl</artifactId>
+    </dependency>
     <dependency>
       <groupId>org.dkpro.core</groupId>
       <artifactId>dkpro-core-api-resources-asl</artifactId>

diff --git a/dkpro-core-io-ancora-asl/src/main/java/org/dkpro/core/io/ancora/AncoraReader.java b/dkpro-core-io-ancora-asl/src/main/java/org/dkpro/core/io/ancora/AncoraReader.java
@@ -18,9 +18,9 @@
 package org.dkpro.core.io.ancora;
 
 import static java.util.Arrays.asList;
-import static org.apache.commons.io.IOUtils.closeQuietly;
 import static org.apache.uima.fit.util.JCasUtil.select;
 import static org.apache.uima.fit.util.JCasUtil.selectCovered;
+import static org.dkpro.core.api.resources.CompressionUtils.getInputStream;
 import static org.dkpro.core.io.ancora.internal.AncoraConstants.ATTR_LEMMA;
 import static org.dkpro.core.io.ancora.internal.AncoraConstants.ATTR_POS;
 import static org.dkpro.core.io.ancora.internal.AncoraConstants.ATTR_WORD;
@@ -33,7 +33,6 @@
 
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.apache.uima.UimaContext;
 import org.apache.uima.analysis_engine.AnalysisEngineProcessException;
@@ -50,9 +49,9 @@
 import org.dkpro.core.api.lexmorph.pos.POSUtils;
 import org.dkpro.core.api.parameter.ComponentParameters;
 import org.dkpro.core.api.parameter.MimeTypes;
-import org.dkpro.core.api.resources.CompressionUtils;
 import org.dkpro.core.api.resources.MappingProvider;
 import org.dkpro.core.api.resources.MappingProviderFactory;
+import org.dkpro.core.api.xml.XmlParserUtils;
 import org.slf4j.Logger;
 import org.xml.sax.Attributes;
 import org.xml.sax.InputSource;
@@ -183,18 +182,15 @@ public void getNext(JCas aJCas)
             throw new IOException(e1);
         }
 
-        InputStream is = null;
-        try {
-            is = CompressionUtils.getInputStream(res.getLocation(), res.getInputStream());
+        try (InputStream is = getInputStream(res.getLocation(), res.getInputStream())) {
 
             // Create handler
             AncoraHandler handler = new AncoraHandler();
             handler.setJCas(aJCas);
             handler.setLogger(getLogger());
 
             // Parse XML
-            SAXParserFactory pf = SAXParserFactory.newInstance();
-            SAXParser parser = pf.newSAXParser();
+            SAXParser parser = XmlParserUtils.newSaxParser();
 
             InputSource source = new InputSource(is);
             source.setPublicId(res.getLocation());
@@ -204,9 +200,6 @@ public void getNext(JCas aJCas)
         catch (ParserConfigurationException | SAXException e) {
             throw new IOException(e);
         }
-        finally {
-            closeQuietly(is);
-        }
 
         if (dropSentencesMissingPosTags) {
             List<FeatureStructure> toRemove = new ArrayList<>();

diff --git a/dkpro-core-io-gigaword-asl/pom.xml b/dkpro-core-io-gigaword-asl/pom.xml
@@ -44,6 +44,10 @@
       <groupId>org.dkpro.core</groupId>
       <artifactId>dkpro-core-api-metadata-asl</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.dkpro.core</groupId>
+      <artifactId>dkpro-core-api-xml-asl</artifactId>
+    </dependency>
     <dependency>
       <groupId>org.dkpro.core</groupId>
       <artifactId>dkpro-core-api-resources-asl</artifactId>

diff --git a/...ord-asl/src/main/java/org/dkpro/core/io/gigaword/internal/AnnotatedGigawordDocuments.java b/...ord-asl/src/main/java/org/dkpro/core/io/gigaword/internal/AnnotatedGigawordDocuments.java
@@ -17,16 +17,17 @@
  */
 package org.dkpro.core.io.gigaword.internal;
 
+import static org.dkpro.core.api.resources.CompressionUtils.getInputStream;
+
 import java.io.BufferedInputStream;
 import java.io.InputStream;
 import java.util.Iterator;
 import java.util.List;
 
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.dkpro.core.api.io.ResourceCollectionReaderBase.Resource;
-import org.dkpro.core.api.resources.CompressionUtils;
+import org.dkpro.core.api.xml.XmlParserUtils;
 
 import com.google.common.collect.AbstractIterator;
 
@@ -48,10 +49,9 @@ private AnnotatedGigawordDocuments(List<AnnotatedGigawordArticle> aArticleList)
     public static AnnotatedGigawordDocuments fromAnnotatedGigawordFile(Resource aResource)
         throws Exception
     {
-        try (InputStream is = new BufferedInputStream(CompressionUtils
-                .getInputStream(aResource.getLocation(), aResource.getInputStream()))) {
-            SAXParserFactory factory = SAXParserFactory.newInstance();
-            SAXParser saxParser = factory.newSAXParser();
+        try (InputStream is = new BufferedInputStream(
+                getInputStream(aResource.getLocation(), aResource.getInputStream()))) {
+            SAXParser saxParser = XmlParserUtils.newSaxParser();
             AnnotatedGigawordParser parser = new AnnotatedGigawordParser(aResource);
             saxParser.parse(is, parser);
             return new AnnotatedGigawordDocuments(parser.getArticleList());

diff --git a/dkpro-core-io-xml-asl/pom.xml b/dkpro-core-io-xml-asl/pom.xml
@@ -36,10 +36,6 @@
       <groupId>org.apache.uima</groupId>
       <artifactId>uimafit-core</artifactId>
     </dependency>
-    <dependency>
-      <groupId>stax</groupId>
-      <artifactId>stax-api</artifactId>
-    </dependency>
     <dependency>
       <groupId>org.codehaus.woodstox</groupId>
       <artifactId>woodstox-core-asl</artifactId>

diff --git a/dkpro-core-io-xml-asl/src/main/java/org/dkpro/core/io/xml/InlineXmlWriter.java b/dkpro-core-io-xml-asl/src/main/java/org/dkpro/core/io/xml/InlineXmlWriter.java
@@ -43,6 +43,7 @@
 import org.dkpro.core.api.io.JCasFileWriter_ImplBase;
 import org.dkpro.core.api.parameter.MimeTypes;
 import org.dkpro.core.api.resources.ResourceUtils;
+import org.dkpro.core.api.xml.XmlParserUtils;
 
 import eu.openminted.share.annotations.api.DocumentationResource;
 
@@ -92,8 +93,8 @@ public void initialize(UimaContext aContext)
         super.initialize(aContext);
 
         if (xslt != null) {
-            TransformerFactory tf = TransformerFactory.newInstance();
             try {
+                TransformerFactory tf = XmlParserUtils.newTransformerFactory();
                 URL url = ResourceUtils.resolveLocation(xslt, this, getContext());
                 transformer = tf.newTransformer(new StreamSource(url.openStream()));
             } catch (Exception e) {

diff --git a/dkpro-core-io-xml-asl/src/main/java/org/dkpro/core/io/xml/XmlDocumentReader.java b/dkpro-core-io-xml-asl/src/main/java/org/dkpro/core/io/xml/XmlDocumentReader.java
@@ -22,7 +22,6 @@
 import java.io.InputStream;
 
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.apache.uima.collection.CollectionException;
 import org.apache.uima.fit.descriptor.MimeTypeCapability;
@@ -33,6 +32,7 @@
 import org.dkpro.core.api.parameter.MimeTypes;
 import org.dkpro.core.api.resources.CompressionUtils;
 import org.dkpro.core.api.xml.CasXmlHandler;
+import org.dkpro.core.api.xml.XmlParserUtils;
 import org.xml.sax.InputSource;
 
 import eu.openminted.share.annotations.api.Component;
@@ -77,8 +77,7 @@ public void getNext(JCas aJCas) throws IOException, CollectionException
             CasXmlHandler handler = new CasXmlHandler(aJCas);
 
             // Parser XML
-            SAXParserFactory pf = SAXParserFactory.newInstance();
-            SAXParser parser = pf.newSAXParser();
+            SAXParser parser = XmlParserUtils.newSaxParser();
 
             InputSource source = new InputSource(is);
             source.setPublicId(res.getLocation());

diff --git a/dkpro-core-io-xml-asl/src/main/java/org/dkpro/core/io/xml/XmlDocumentWriter.java b/dkpro-core-io-xml-asl/src/main/java/org/dkpro/core/io/xml/XmlDocumentWriter.java
@@ -20,10 +20,10 @@
 import static javax.xml.transform.OutputKeys.INDENT;
 import static javax.xml.transform.OutputKeys.METHOD;
 import static javax.xml.transform.OutputKeys.OMIT_XML_DECLARATION;
+import static org.dkpro.core.api.xml.XmlParserUtils.newTransformerFactory;
 
 import java.io.OutputStream;
 
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.sax.SAXTransformerFactory;
 import javax.xml.transform.sax.TransformerHandler;
 import javax.xml.transform.stream.StreamResult;
@@ -95,8 +95,7 @@ public class XmlDocumentWriter
     public void process(JCas aJCas) throws AnalysisEngineProcessException
     {
         try (OutputStream docOS = getOutputStream(aJCas, filenameSuffix)) {
-            SAXTransformerFactory tf = (SAXTransformerFactory) TransformerFactory.newInstance();
-            tf.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
+            SAXTransformerFactory tf = (SAXTransformerFactory) newTransformerFactory();
             TransformerHandler th = tf.newTransformerHandler();
             if (omitXmlDeclaration) {
                 th.getTransformer().setOutputProperty(OMIT_XML_DECLARATION, "yes");