解决javax.xml.parsers.DocumentBuilderFactory.setFeature(Ljava/lang/String;Z)V异 ...

2021-11-4 12:37| 发布者: zhaojun917| 查看: 1688| 评论: 0

摘要: 1 问题在解决微信支付XXE（XML外部实体注入漏洞）的时使用了setFeature()方法，出现了如下异常：java.lang.AbstractMethodError:javax.xml.parsers.DocumentBuilderFactory.setFeature(Ljava/lang/String;Z)2 原因不 ...

1 问题

在解决微信支付XXE（XML外部实体注入漏洞）的时使用了setFeature()方法，出现了如下异常：

java.lang.AbstractMethodError:javax.xml.parsers.DocumentBuilderFactory.setFeature(Ljava/lang/String;Z)

2 原因

不同jar包的多xml解析器冲突

3 解决

微信支付创建xml解析器的官方SDK源码

public static DocumentBuilder newDocumentBuilder() throws ParserConfigurationException {

DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();

documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);

documentBuilderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

documentBuilderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

documentBuilderFactory.setXIncludeAware(false);

documentBuilderFactory.setExpandEntityReferences(false);

return documentBuilderFactory.newDocumentBuilder();

}

解决方法：在使用DocumentBuilderFactory前加入这一行代码

System.setProperty("javax.xml.parsers.DocumentBuilderFactory", "com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl");

完整代码