com.predic8.membrane.core.interceptor.xmlprotection

Class XMLProtectionInterceptor

java.lang.Object

com.predic8.membrane.core.interceptor.AbstractInterceptor

com.predic8.membrane.core.interceptor.xmlprotection.XMLProtectionInterceptor

All Implemented Interfaces:

Interceptor

public class XMLProtectionInterceptor
extends AbstractInterceptor

Description

Prohibits XML documents to be passed through that look like XML attacks on older parsers. Too many attributes, too long element names are such indications. DTD definitions will simply be removed.

Topic

6. Security

Nested Class Summary

Nested classes/interfaces inherited from interface com.predic8.membrane.core.interceptor.Interceptor

Interceptor.Flow

Field Summary

Fields inherited from class com.predic8.membrane.core.interceptor.AbstractInterceptor

id, name, router

Constructor Summary

Constructors

Constructor and Description
XMLProtectionInterceptor()

Method Summary

Modifier and Type	Method and Description
String	getShortDescription()
Outcome	handleRequest(Exchange exc)
void	setMaxAttibuteCount(int maxAttibuteCount)
void	setMaxElementNameLength(int maxElementNameLength)
void	setRemoveDTD(boolean removeDTD)

Methods inherited from class com.predic8.membrane.core.interceptor.AbstractInterceptor

getDisplayName, getFlow, getHelpId, getId, getLongDescription, getRouter, getRule, handleAbort, handleResponse, init, init, setDisplayName, setFlow, setId

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

XMLProtectionInterceptor

public XMLProtectionInterceptor()

Method Detail

handleRequest

public Outcome handleRequest(Exchange exc)
                      throws Exception

Specified by:

handleRequest in interface Interceptor

Overrides:

handleRequest in class AbstractInterceptor

Throws:

Exception

setMaxAttibuteCount

public void setMaxAttibuteCount(int maxAttibuteCount)

Default

1000

Description

If an incoming request exceeds this limit, it will be discarded.

setMaxElementNameLength

public void setMaxElementNameLength(int maxElementNameLength)

Default

1000

Description

If an incoming request exceeds this limit, it will be discarded.

setRemoveDTD

public void setRemoveDTD(boolean removeDTD)

Default

true

Description

Whether to remove the DTD from incoming requests.

getShortDescription

public String getShortDescription()

Specified by:

getShortDescription in interface Interceptor

Overrides:

getShortDescription in class AbstractInterceptor