OSDN > Finden Software > Multimedia > Graphics > 3D Modeling > MikuToga > SCM > git > TogaGem > Commit

MikuToga
Fork
TogaGem
Vmd2XML
Pmd2XML
Vmd2XML
TogaGem
Pmd2XML

TogaGem: Commit

TogaGemは、3D動画制作ツール、MikuMikuDance(MMD)で用いられる各種データファイルを読み書きするためのJavaライブラリです。
旧TogaParserライブラリの資産は、TogaGemライブラリに吸収されました。

Revision	4a44b5f608e5d55be6704728c4455b8013615483 (tree)
Zeit	2019-06-24 00:06:06
Autor	Olyutorskii <olyutorskii@user...>
Commiter	Olyutorskii

Move out xml-xsd info from resolver.

--- a/CHANGELOG.txt

+++ b/CHANGELOG.txt

		@@ -7,6 +7,7 @@ TogaGem 変更履歴
7	7	X.XXX.X (XXXX-XX-XX)
8	8	* Split entity resolver from resource resolver to prevent XXE vulnerability.
9	9	* Make Schema-factory safe to prevent XXE vulnerability.
	10	+ * Move out xml-xsd info from resolver.
10	11
11	12	3.121.2 (2019-06-06)
12	13	・DatatypeIo is public now, for replacing JAXB.

--- a/src/main/java/jp/sfjp/mikutoga/xml/SchemaUtil.java

+++ b/src/main/java/jp/sfjp/mikutoga/xml/SchemaUtil.java

		@@ -30,8 +30,36 @@ import org.xml.sax.SAXNotSupportedException;
30	30	*/
31	31	public final class SchemaUtil {
32	32
	33	+
	34	+ /** XML Schema. */
	35	+ public static final String SCHEMA_XML =
	36	+ "http://www.w3.org/2001/xml.xsd";
	37	+
	38	+ /** XSD namespace. */
	39	+ public static final String NS_XSD =
	40	+ "http://www.w3.org/2001/XMLSchema-instance";
	41	+
	42	+ private static final String LOCAL_SCHEMA_XML =
	43	+ "resources/xmlspace.xsd";
	44	+
	45	+ private static final URI URI_XSD_ORIG;
	46	+ private static final URI URI_XSD_LOCAL;
	47	+
33	48	private static final String ALLOWED_USCHEMA = "http";
34	49
	50	+ private static final Class<?> THISCLASS = SchemaUtil.class;
	51	+
	52	+
	53	+ static{
	54	+ URL redirectRes = THISCLASS.getResource(LOCAL_SCHEMA_XML);
	55	+ String redirectResName = redirectRes.toString();
	56	+
	57	+ URI_XSD_ORIG = URI.create(SCHEMA_XML);
	58	+ URI_XSD_LOCAL = URI.create(redirectResName);
	59	+
	60	+ assert ALLOWED_USCHEMA.equalsIgnoreCase(URI_XSD_ORIG.getScheme());
	61	+ }
	62	+
35	63
36	64	/**
37	65	* 隠しコンストラクタ。

		@@ -43,6 +71,17 @@ public final class SchemaUtil {
43	71
44	72
45	73	/**
	74	+ * build xml.xsd redirection info.
	75	+ *
	76	+ * @return resolver
	77	+ */
	78	+ public static XmlResourceResolver buildXmlXsdResolver(){
	79	+ XmlResourceResolver result = new XmlResourceResolver();
	80	+ result.putRedirected(URI_XSD_ORIG, URI_XSD_LOCAL);
	81	+ return result;
	82	+ }
	83	+
	84	+ /**
46	85	* Build SchemaFactory for XML Schema but safety.
47	86	*
48	87	* <p>Includes some considerations for XXE vulnerabilities.

--- a/src/main/java/jp/sfjp/mikutoga/xml/XmlResourceResolver.java

+++ b/src/main/java/jp/sfjp/mikutoga/xml/XmlResourceResolver.java

		@@ -27,21 +27,8 @@ import org.w3c.dom.ls.LSResourceResolver;
27	27	public class XmlResourceResolver
28	28	implements LSResourceResolver{
29	29
30		- /** XML Schema. */
31		- public static final String SCHEMA_XML =
32		- "http://www.w3.org/2001/xml.xsd";
33		-
34		- /** XSD名前空間。 */
35		- public static final String NS_XSD =
36		- "http://www.w3.org/2001/XMLSchema-instance";
37		-
38		- private static final String LOCAL_SCHEMA_XML =
39		- "resources/xmlspace.xsd";
40		-
41	30	private static final URI EMPTY_URI = URI.create("");
42	31
43		- private static final Class<?> THISCLASS = XmlResourceResolver.class;
44		-
45	32
46	33	private final Map<URI, URI> uriMap;
47	34

		@@ -52,21 +39,11 @@ public class XmlResourceResolver
52	39	public XmlResourceResolver(){
53	40	super();
54	41
55		- assert this.getClass().equals(THISCLASS);
56		-
57	42	Map<URI, URI> map;
58	43	map = new HashMap<>();
59	44	map = Collections.synchronizedMap(map);
60	45	this.uriMap = map;
61	46
62		- URL redirectRes = THISCLASS.getResource(LOCAL_SCHEMA_XML);
63		- String redirectResName = redirectRes.toString();
64		-
65		- URI originalURI = URI.create(SCHEMA_XML);
66		- URI redirectURI = URI.create(redirectResName);
67		-
68		- putRedirectedImpl(originalURI, redirectURI);
69		-
70	47	return;
71	48	}
72	49