tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 34034] - Jasper didn't respect external entities
Date Fri, 18 Mar 2005 15:15:31 GMT
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG·
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=34034>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND·
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=34034





------- Additional Comments From hgomez@apache.org  2005-03-18 16:15 -------
It's a trick :

if (systemId.startsWith("file:///WEB-INF/"))
  return new InputSource(ctxt.getResourceAsStream(systemId.substring(7)));

XML parser have a pseudo root origine set to /WEB-INF/ and as such you get the
systemId filed with 'file:///WEB-INF/whatever.xml' when you have defined a
<ENTITY what SYSTEM "whatever.xml">

With the substring 7 we remove the "file:////" and as such get
"/WEB-INF/whatever.xml" from ServletContext via getResourceAsStream.

So it should works EVEN if the webapp is not file based.

I do that to respect WHAT YOU REQUIRED, ie no InputSource from a File, just from
a resource.



-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org


Mime
View raw message