Class SourceHttpMessageConverter<T extends Source>

java.lang.Object
org.springframework.http.converter.AbstractHttpMessageConverter<T>
org.springframework.http.converter.xml.SourceHttpMessageConverter<T>
Type Parameters:
T - the converted object type
All Implemented Interfaces:
HttpMessageConverter<T>
public class SourceHttpMessageConverter<T extends Source> extends AbstractHttpMessageConverter<T>
Implementation of HttpMessageConverter that can read and write Source objects.

Security considerations: supportDtd and processExternalEntities only apply when reading a request body into a DOMSource, SAXSource or StAXSource. They do not apply to writing. Spring Framework trusts the application and its data sources, so the XML being written is assumed to be application-controlled. Only reading untrusted XML is protected against XXE.

When a handler declares a StreamSource (or a plain Source, which resolves to it), the application opts in to receiving the raw, unparsed request body. That body is not processed by this converter and the application is responsible for any later processing of it, including writing it back out in a response. Echoing untrusted XML back to the client is an application-level decision; the application must parse or sanitize that XML safely first (for example by declaring a DOMSource).

This behavior is by design and is not considered a vulnerability in Spring Framework. Reports of XXE on the write path, or from raw StreamSource pass-through, will be closed as such.

Since:
3.0
Author:
Arjen Poutsma, Rossen Stoyanchev, Juergen Hoeller

  • Constructor Details

    • SourceHttpMessageConverter

      public SourceHttpMessageConverter()
      Sets the supportedMediaTypes to text/xml and application/xml, and application/*+xml.

  • Method Details

    • setSupportDtd

      public void setSupportDtd(boolean supportDtd)
      Indicate whether DTD parsing should be supported when reading DOMSource, SAXSource and StAXSource request content.

      Default is false meaning that DTD is disabled.

      This setting does not apply to raw StreamSource content or to writing Source instances; see the class-level documentation.

    • isSupportDtd

      public boolean isSupportDtd()
      Return whether DTD parsing is supported.

    • setProcessExternalEntities

      public void setProcessExternalEntities(boolean processExternalEntities)
      Indicate whether external XML entities are processed when converting to a Source.

      Default is false, meaning that external entities are not resolved.

      This setting does not apply to raw StreamSource content or to writing Source instances; see the class-level documentation.

      Note: setting this option to true also automatically sets setSupportDtd(boolean) to true.

    • isProcessExternalEntities

      public boolean isProcessExternalEntities()
      Return whether XML external entities are allowed.

    • supports

      public boolean supports(Class<?> clazz)
      Description copied from class: AbstractHttpMessageConverter
      Indicates whether the given class is supported by this converter.
      Specified by:
      supports in class AbstractHttpMessageConverter<T extends Source>
      Parameters:
      clazz - the class to test for support
      Returns:
      true if supported; false otherwise

    • readInternal

      protected T readInternal(Class<? extends T> clazz, HttpInputMessage inputMessage) throws IOException, HttpMessageNotReadableException
      Description copied from class: AbstractHttpMessageConverter
      Abstract template method that reads the actual object. Invoked from AbstractHttpMessageConverter.read(Class, HttpInputMessage).
      Specified by:
      readInternal in class AbstractHttpMessageConverter<T extends Source>
      Parameters:
      clazz - the type of object to return
      inputMessage - the HTTP input message to read from
      Returns:
      the converted object
      Throws:
      IOException - in case of I/O errors
      HttpMessageNotReadableException - in case of conversion errors

    • getContentLength

      protected @Nullable Long getContentLength(T t, @Nullable MediaType contentType)
      Description copied from class: AbstractHttpMessageConverter
      Returns the content length for the given type.

      By default, this returns null, meaning that the content length is unknown. Can be overridden in subclasses.

      Overrides:
      getContentLength in class AbstractHttpMessageConverter<T extends Source>
      Parameters:
      t - the type to return the content length for
      Returns:
      the content length, or null if not known

    • writeInternal

      protected void writeInternal(T t, HttpOutputMessage outputMessage) throws IOException, HttpMessageNotWritableException
      Description copied from class: AbstractHttpMessageConverter
      Abstract template method that writes the actual body. Invoked from AbstractHttpMessageConverter.write(T, MediaType, HttpOutputMessage).
      Specified by:
      writeInternal in class AbstractHttpMessageConverter<T extends Source>
      Parameters:
      t - the object to write to the output message
      outputMessage - the HTTP output message to write to
      Throws:
      IOException - in case of I/O errors
      HttpMessageNotWritableException - in case of conversion errors

    • canWriteRepeatedly

      public boolean canWriteRepeatedly(T t, @Nullable MediaType contentType)
      Description copied from interface: HttpMessageConverter
      Indicates whether this message converter can write the given payload multiple times.

      This can be used by HTTP client libraries to know whether a message can be sent again, for example after an HTTP redirect. The default implementation returns false. This typically returns false if the payload can be read only once.

      Parameters:
      t - the object t
      contentType - the content type to use when writing.
      Returns:
      true if t can be written repeatedly; false otherwise

    • supportsRepeatableWrites

      protected boolean supportsRepeatableWrites(T t)
      Description copied from class: AbstractHttpMessageConverter
      Indicates whether this message converter can write the given object multiple times.

      The default implementation returns false.

      Overrides:
      supportsRepeatableWrites in class AbstractHttpMessageConverter<T extends Source>
      Parameters:
      t - the object t
      Returns:
      true if t can be written repeatedly; false otherwise