matrei commented on PR #16331:
URL: https://github.com/apache/grails-core/pull/16331#issuecomment-5615653251
**I think this is the best solution for the DOCTYPE reading:**
What I would change. The two trust levels want two parsers, and the readers
of trusted descriptors know they are reading trusted descriptors. Keep the
strict default for request bodies and let the descriptor readers ask for
DOCTYPE tolerance explicitly:
```java
// SpringIOUtils
public static XmlSlurper createXmlSlurper() throws ... { //
strict, for request bodies
return createXmlSlurper(false);
}
public static XmlSlurper createXmlSlurper(boolean allowDocTypeDeclaration)
throws ... {
return new
XmlSlurper(createParserFactory(allowDocTypeDeclaration).newSAXParser());
}
```
with TldReader, WebXmlTagLibraryReader and PluginUtils passing true.
External general and parameter entities, DTD grammar loading and external DTD
retrieval stay off on both factories, so the tolerant parser still resolves a
file:// entity to nothing and skips the web-jsptaglibrary_1_2.dtd reference
instead of fetching it. That needs no configuration key, no upgrade note for
JSP users, and does not relax request-body parsing as a side effect of using
JSTL.
We could optionally check the config value and pass that in the no-param
method.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
