java - Disallow entity declarations but allow DTDs -

i given xml document must allowed have document type declaration (dtd), prohibit entity declarations.

the xml document parsed saxparser.parse(), follows:

saxparserfactory factory = saxparserfactory.newinstance();  factory.setfeature("http://xml.org/sax/features/external-general-entities", false); factory.setfeature("http://xml.org/sax/features/external-parameter-entities", false); factory.setvalidating(true);  saxparser parser = factory.newsaxparser(); 

the xml passed parser inputsource:

inputsource inputsource= ... ; parser.parse(inputsource, handler); 

and handler has resolveentity method, saxparser.parse() calls:

public inputsource resolveentity(string pubid, string sysid) throws saxexception {   inputsource inputsource = null;   try {      inputsource = entityresolver.resolveentity(publicid, systemid);   }   catch (ioexception e) {      throw new saxexception(e);   }   return inputsource; } 

when pass in xml file entity reference, seems nothing being done - no exceptions thrown , nothing stripped - or prohibited entity reference.

here example of bad xml using. dtd should allowed, !entity line should disallowed:

<!doctype foo system "foo.dtd" [     <!entity gotcha system "file:///gotcha.txt"> <!-- disallowed--> ]>  <label>&gotcha;</label> 

what need make sure entity references disallowed in xml, dtds still allowed?

set org.xml.sax.ext.declhandler on saxparser.

parser.setproperty("http://xml.org/sax/properties/declaration-handler", mydeclhandler); 

the declhandler gets notified when internal entity declaration parsed. disallow entity decls can simple throw saxexception:

public class mydeclhandler extends org.xml.sax.ext.defaulthandler2 {      public void internalentitydecl(string name, string value) throws saxexception {          throw new saxexception("not allowed");      } }