如何防止特征 FEATURE_SECURE_PROCESSING 设置为 true 的 TransformerFactory 剥离属性？
Posted
技术标签:
【中文标题】如何防止特征 FEATURE_SECURE_PROCESSING 设置为 true 的 TransformerFactory 剥离属性？【英文标题】：How to prevent a TransformerFactory with feature FEATURE_SECURE_PROCESSING set true from stripping attributes? 【发布时间】：2021-06-27 23:56:04 【问题描述】：我有 2 个TransformerFactory 实例：一个默认实例，一个具有安全处理功能集true。每个都为同一个 XSL 文件生成一个Templates。当我对每个 XML 数据应用转换时，我会收到不同的结果。
从安全的TransformerFactory 生成的输出从我的元素中剥离了属性。
控制台输出标识：SystemId Unknown; Line #xx; Column #yy; "zzzz" attribute is not allowed on the vvvv element!
这是怎么回事，我该如何预防？
以后我需要将安全处理设置为 true。请注意，如果我使用 xsl:attribute 标记 (<xsl:attribute name="variable">value</xsl:attribute>) 应用该属性，则转换不会忽略它，但是我有许多比示例大得多的 XSL 文件，更改它需要付出巨大的努力。
必须有一个设置来允许安全处理，但也允许严格的属性。
研究部分
Similar question 未得到答复，因为它与关注 Apache-FO 而不是实际问题（即安全转换器）混为一谈。
根据this question，这可能是 xalan-2.7.1/xalan-2.7.2 库的问题；我会研究和更新依赖关系。
数据部分
示例代码
package test;
import java.io.File;
import java.io.StringReader;
import java.io.StringWriter;
import java.nio.charset.Charset;
import javax.xml.transform.Templates;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.stream.StreamResult;
import javax.xml.transform.stream.StreamSource;
import org.apache.commons.io.FileUtils;
public class XformTest
public static void main(String[] args)
try
File BASE_FOLDER = new File("C:\\path-to-work-folder\\");
File outFolder = new File(BASE_FOLDER, "out_" + System.currentTimeMillis());
outFolder.mkdirs();
String xmlData = FileUtils.readFileToString(new File(BASE_FOLDER, "data.xml"), Charset.defaultCharset());
File xslFile = new File(BASE_FOLDER, "format.xsl");
StreamSource dataSource = null;
StreamSource xslSource = null;
TransformerFactory factory = null;
Templates template = null;
Transformer transformer = null;
StringWriter writer = null;
File outFile = null;
String result = null;
// DEFAULT
System.out.println("DEFAULT");
outFile = new File(outFolder, "default.html");
dataSource = new StreamSource(new StringReader(xmlData));
xslSource = new StreamSource(FileUtils.openInputStream(xslFile));
factory = TransformerFactory.newInstance();
template = factory.newTemplates(xslSource);
transformer = template.newTransformer();
writer = new StringWriter();
transformer.transform(dataSource, new StreamResult(writer));
result = writer.toString();
FileUtils.writeStringToFile(outFile, result, Charset.defaultCharset());
// SECURE
System.out.println("SECURE");
outFile = new File(outFolder, "secure.html");
dataSource = new StreamSource(new StringReader(xmlData));
xslSource = new StreamSource(FileUtils.openInputStream(xslFile));
factory = TransformerFactory.newInstance();
factory.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
template = factory.newTemplates(xslSource);
transformer = template.newTransformer();
writer = new StringWriter();
transformer.transform(dataSource, new StreamResult(writer));
result = writer.toString();
FileUtils.writeStringToFile(outFile, result, Charset.defaultCharset());
catch (Exception ex)
ex.printStackTrace();
数据文件“data.xml”
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<page>
<record>
<data>0</data>
<moredata>888.88</moredata>
<info>12345</info>
<name>foo</name>
</record>
<Address1>123 ANY STREET</Address1>
<Address2>SUITE 100</Address2>
<City>ALBUQUERQUE</City>
<Country>USA</Country>
<Fax>1-(888)-686-8281</Fax>
<Name>MISC 000000AA000CDDE</Name>
<State>NM</State>
<Zip>99999-999</Zip>
</page>
XSL 文件 format.xsl
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:output method="xml" indent="yes" encoding="UTF-8"/>
<xsl:template match="/">
<xsl:variable name="record" select="page/record"/>
<html>
<body>
<form>
<input type="hidden" name="hiddenInputName" value="SpecialValue"/>
<table border="0">
<tr><td ><center><span class="Heading">HELP ME FIGURE THIS OUT</span></center><br/>DATA: <xsl:value-of select="page/City"/></td></tr>
<tr><td ><span class="BodyNormal"><b><i>The span should have said BodyNormal 100% and the hidden input should have a name and value of hiddenInputName and SpecialValue respectively</i></b></span></td></tr>
</table>
</form>
</body>
</html>
</xsl:template>
</xsl:stylesheet>
默认（预期）输出：“default.html”
<?xml version="1.0" encoding="UTF-8"?><html>
<body>
<form>
<input value="SpecialValue" name="hiddenInputName" type="hidden"/>
<table border="0" >
<tr>
<td >
<center>
<span class="Heading">HELP ME FIGURE THIS OUT</span>
</center>
<br/>DATA: ALBUQUERQUE</td>
</tr>
<tr>
<td >
<span class="BodyNormal">
<b>
<i>The span should have said BodyNormal 100% and the hidden input should have a name and value of hiddenInputName and SpecialValue respectively</i>
</b>
</span>
</td>
</tr>
</table>
</form>
</body>
</html>
安全（截断）输出：“secure.html”
<?xml version="1.0" encoding="UTF-8"?><html>
<body>
<form>
<input/>
<table>
<tr>
<td>
<center>
<span>HELP ME FIGURE THIS OUT</span>
</center>
<br/>DATA: ALBUQUERQUE</td>
</tr>
<tr>
<td>
<span>
<b>
<i>The span should have said BodyNormal 100% and the hidden input should have a name and value of hiddenInputName and SpecialValue respectively</i>
</b>
</span>
</td>
</tr>
</table>
</form>
</body>
</html>
控制台输出
DEFAULT
SECURE
SystemId Unknown; Line #9; Column #67; "type" attribute is not allowed on the input element!
SystemId Unknown; Line #9; Column #67; "name" attribute is not allowed on the input element!
SystemId Unknown; Line #9; Column #67; "value" attribute is not allowed on the input element!
SystemId Unknown; Line #10; Column #32; "width" attribute is not allowed on the table element!
SystemId Unknown; Line #10; Column #32; "border" attribute is not allowed on the table element!
SystemId Unknown; Line #11; Column #22; "width" attribute is not allowed on the td element!
SystemId Unknown; Line #11; Column #52; "class" attribute is not allowed on the span element!
SystemId Unknown; Line #12; Column #22; "width" attribute is not allowed on the td element!
SystemId Unknown; Line #12; Column #47; "class" attribute is not allowed on the span element!
【问题讨论】：
【参考方案1】：已解决。
这是由于 xalan-2.7.2。 Here is the bug in Xalan-J
切换到 xalan-2.7.1 解决了这个问题，但我最终迁移到带有嵌入式补丁的 2.7.2_3，等待未来的发布。
<dependency>
<groupId>org.apache.servicemix.bundles</groupId>
<artifactId>org.apache.servicemix.bundles.xalan</artifactId>
<version>2.7.2_3</version><!--$NO-MVN-MAN-VER$-->
</dependency>
【讨论】：
以上是关于如何防止特征 FEATURE_SECURE_PROCESSING 设置为 true 的 TransformerFactory 剥离属性？的主要内容，如果未能解决你的问题，请参考以下文章