spring mvc processing xml with relative path to dtd

Question

My webservice receives an xml from a third-party source, which contains a !DOCTYPE declaration. Therefore I must use the second method in my controller to parse the xml document, the first one gives me this exception: Failed to read HTTP message: org.springframework.http.converter.HttpMessageNotReadableException: Could not unmarshal to [class com.example.MeterBusXml]: null; nested exception is javax.xml.bind.UnmarshalException - with linked exception: [org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 48; DOCTYPE is disallowed when the feature "http://apache.org/xml/features/disallow-doctype-decl" set to true.]

I have no control over the application which posts the xml, so I must adapt my webservice to parse it with the dtd.

My question is, what is the spring framework's way of injecting the EntityResolver into every XMLReader instance?

@RestController
public class MeterBusDataController {

  @RequestMapping (
    consumes = APPLICATION_XML_VALUE,
    method = POST,
    path = "/meterbus1"
  )
  public void method1(@RequestBody MeterBusXml xml) {
    System.out.println(xml);
  }

  @RequestMapping(
    method = POST,
    path = "/meterbus2"
  )
  public void method2(HttpServletRequest rq) throws IOException, ParserConfigurationException, SAXException, JAXBException {
    JAXBContext jc = newInstance(MeterBusXml.class);
    Unmarshaller um = jc.createUnmarshaller();
    SAXParserFactory spf = SAXParserFactory.newInstance();
    spf.setNamespaceAware(true);
    spf.setValidating(true);
    SAXParser sp = spf.newSAXParser();
    XMLReader xr = sp.getXMLReader();
    xr.setEntityResolver(new EntityResolver() {
      @Override
      public InputSource resolveEntity(String publicId, String systemId) throws SAXException, IOException {
        return new InputSource(new StringReader(""));
      }
    });
    BufferedReader reader = rq.getReader();
    InputSource inputSource = new InputSource(reader);
    SAXSource saxSource = new SAXSource(xr, inputSource);
    MeterBusXml xml = (MeterBusXml)um.unmarshal(saxSource);
    System.out.println(xml);
  }
}

See the following document for an example of the mbus.xml I'm trying to unmarshal. http://prevodniky.sk/products/product_EthMBus_common/download/Ethernet_converters_exports_v1_02_EN.pdf

Answer 1

I've found the root of the problem. First I tried to create and configure a Jaxb2Marshaller bean, but that did not work out. Then I realized, I need a HttpMessageConverter, so I had to override the extendMessageConverters method in the WebMvcConfigurerAdapter class, and set the required properties on Jaxb2RootElementHttpMessageConverter. This message converter does not use a Jaxb2Marshaller, but it's internal workings are very similar.

setSupportDtd(true) is required, to force the parser to accept the !DOCTYPE declaration.

setProcessExternalEntities(false) is required, because if this property is false, then the converter uses a blank EntityResolver, just as I did in method2.

@Configuration
public class WebConfiguration extends WebMvcConfigurerAdapter {

  @Override
  public void extendMessageConverters(List<HttpMessageConverter<Jaxb2RootElementHttpMessageConverter?>> converters) {
    for (final Iterator<HttpMessageConverter<?>> iterator = converters.iterator(); iterator.hasNext();) {
      HttpMessageConverter<?> next = iterator.next();
      if (next instanceof Jaxb2RootElementHttpMessageConverter) {
        Jaxb2RootElementHttpMessageConverter jaxbConverter = (Jaxb2RootElementHttpMessageConverter) next;
        jaxbConverter.setProcessExternalEntities(false);
        jaxbConverter.setSupportDtd(true);
      }
    }
  }
}