Friday Aug 08, 2014

Spotlight on GlassFish 4.1: #4 JAXP accessExternalSchema

'Spotlight on GlassFish 4.1' is a series of posts that highlights specific enhancements of the upcoming GlassFish 4.1 release. It could be a new feature, a fix, a behaviour change, a tip, etc.

#4 JAXP 1.5 accessExternalSchema

GlassFish 4.1 supports recent JDK versions (JDK 7 u65+ and JDK 8 u5+). Sometime, those newer JDKs might have some side effect as they bring new features too. 

For example, several properties have been introduced in JAXP 1.5 (JDK 7u40+ and JDK 8+). Properties which are used to set restrictions when JAXP is used to process untrusted XML contents. And by default, those restrictions are set!

GF 4.1 is configured to offer the behavior of GF 4.0 used with an older JAXP release (prior to JAXP 1.5), i.e. no restriction on schemas processing. So by default, a GF 4.1 domain.xml is configured with the following JVM option to allow all schemas to be processed: <jvm-options>-Djavax.xml.accessExternalSchema=all </jvm-options>
This configuration obviously assumes that your external XML content is trusted or at least sanitised by an XML firewall. This is applicable to JAXP 1.5 (and above).

Tuesday Dec 05, 2006

JAXP 1.4 FCS/Final Now Available

XML Duke

JAXP 1.4 is now final. This is a "maintenance release" (JSR 206) but a substantial one. The main new addition is support for StAX (JCP, wikipedia) but there are other changes too (Change Log). This is the same version that goes into Java SE 6; you can also use it with JRE 1.4 and JRE 5.0 using the Endorsed Standard Override mechanism.

The implementation is delivered as two JARS (API + Impl) for simplicity and uses the StAX and JAXP implementations from GlassFish which build on Xerces 2 Java. Check the blogs from Santiago and Norm for some more details.

All this code is Open Source, and so will be the implementation of the next version of the spec.

Tuesday Aug 08, 2006

Finding Factory Classes in JAXP

Head Shot of Santiago

Like earlier versions, the JAXP 1.4 API (Java.Net OSS project, spec, JavaDocs) includes a pluggability layer to switch implementations using a Factory pattern. The whole area is not very well understood by the developers, and Santiago's detailed blog provides a very good summary.

The intrinsic problem is that this is an area where the spec can be improved, so start preparing your feedback for the next version of the spec... we are going to do it all at Java.Net and a main focus will be improved usability.

Sunday Jun 25, 2006

JAXP 1.4 JARs added to Java.Net Maven Repository

Maven Logo

We continue to add GlassFish components to the Java.Net Maven Repository: Santiago reports that JAXP 1.4 (part of Java SE 6 (Mustang)) is the latest Addition to the Maven Repository.

Earlier additions to the repository include: Java Persistence and EJB 3.0, JSTL 1.2, Servlet 2.5 and JSP 2.0 and JSP 2.1, XML Stream, Fast Infoset, JSFs, JavaMail and Activation, JAXB, JAX-WS and SAAJ.