001: /*
002: * Licensed to the Apache Software Foundation (ASF) under one or more
003: * contributor license agreements. See the NOTICE file distributed with
004: * this work for additional information regarding copyright ownership.
005: * The ASF licenses this file to You under the Apache License, Version 2.0
006: * (the "License"); you may not use this file except in compliance with
007: * the License. You may obtain a copy of the License at
008: *
009: * http://www.apache.org/licenses/LICENSE-2.0
010: *
011: * Unless required by applicable law or agreed to in writing, software
012: * distributed under the License is distributed on an "AS IS" BASIS,
013: * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014: * See the License for the specific language governing permissions and
015: * limitations under the License.
016: */
017:
018: package org.apache.xerces.util;
019:
020: /**
021: * This class is a container for parser settings that relate to
022: * security, or more specifically, it is intended to be used to prevent denial-of-service
023: * attacks from being launched against a system running Xerces.
024: * Any component that is aware of a denial-of-service attack that can arise
025: * from its processing of a certain kind of document may query its Component Manager
026: * for the property (http://apache.org/xml/properties/security-manager)
027: * whose value will be an instance of this class.
028: * If no value has been set for the property, the component should proceed in the "usual" (spec-compliant)
029: * manner. If a value has been set, then it must be the case that the component in
030: * question needs to know what method of this class to query. This class
031: * will provide defaults for all known security issues, but will also provide
032: * setters so that those values can be tailored by applications that care.
033: *
034: * @author Neil Graham, IBM
035: *
036: * @version $Id: SecurityManager.java 447241 2006-09-18 05:12:57Z mrglavas $
037: */
038: public final class SecurityManager {
039:
040: //
041: // Constants
042: //
043:
044: /** Default value for entity expansion limit. **/
045: private final static int DEFAULT_ENTITY_EXPANSION_LIMIT = 100000;
046:
047: /** Default value of number of nodes created. **/
048: private final static int DEFAULT_MAX_OCCUR_NODE_LIMIT = 3000;
049:
050: //
051: // Data
052: //
053:
054: /** Entity expansion limit. **/
055: private int entityExpansionLimit;
056:
057: /** W3C XML Schema maxOccurs limit. **/
058: private int maxOccurLimit;
059:
060: /**
061: * Default constructor. Establishes default values
062: * for known security vulnerabilities.
063: */
064: public SecurityManager() {
065: entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT;
066: maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT;
067: }
068:
069: /**
070: * <p>Sets the number of entity expansions that the
071: * parser should permit in a document.</p>
072: *
073: * @param limit the number of entity expansions
074: * permitted in a document
075: */
076: public void setEntityExpansionLimit(int limit) {
077: entityExpansionLimit = limit;
078: }
079:
080: /**
081: * <p>Returns the number of entity expansions
082: * that the parser permits in a document.</p>
083: *
084: * @return the number of entity expansions
085: * permitted in a document
086: */
087: public int getEntityExpansionLimit() {
088: return entityExpansionLimit;
089: }
090:
091: /**
092: * <p>Sets the limit of the number of content model nodes
093: * that may be created when building a grammar for a W3C
094: * XML Schema that contains maxOccurs attributes with values
095: * other than "unbounded".</p>
096: *
097: * @param limit the maximum value for maxOccurs other
098: * than "unbounded"
099: */
100: public void setMaxOccurNodeLimit(int limit) {
101: maxOccurLimit = limit;
102: }
103:
104: /**
105: * <p>Returns the limit of the number of content model nodes
106: * that may be created when building a grammar for a W3C
107: * XML Schema that contains maxOccurs attributes with values
108: * other than "unbounded".</p>
109: *
110: * @return the maximum value for maxOccurs other
111: * than "unbounded"
112: */
113: public int getMaxOccurNodeLimit() {
114: return maxOccurLimit;
115: }
116:
117: } // class SecurityManager
|