Class XmlFactoryUtils

java.lang.Object
org.cyclonedx.util.XmlFactoryUtils
public final class XmlFactoryUtils extends Object
Creates JAXP factories for XML processing, preferring the JDK's built-in system-default implementations over the JAXP lookup mechanism.

The standard newInstance() lookup uses the classpath (ServiceLoader / system properties), so an outdated XML parser leaking onto the classpath (e.g. Xerces 2.x pulled in transitively by another library) would be picked up and break BOM parsing and validation with errors like Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized, because such parsers pre-date the JAXP 1.5 secure-processing properties. See cyclonedx-gradle-plugin#349.

An implementation explicitly requested via the JAXP system properties (javax.xml.parsers.DocumentBuilderFactory / javax.xml.validation.SchemaFactory:<schemaLanguage>) is still honored, as that is a deliberate configuration choice rather than an accidental classpath leak.

The newDefaultInstance() factory methods only exist since Java 9 while this library targets Java 8, so they are invoked reflectively, falling back to the standard lookup.

Since:
13.1.0

  • Method Details

    • newDocumentBuilderFactory

      public static DocumentBuilderFactory newDocumentBuilderFactory()
      Creates a new DocumentBuilderFactory, preferring the JDK's built-in implementation unless one is explicitly requested via the javax.xml.parsers.DocumentBuilderFactory system property.
      Returns:
      a new DocumentBuilderFactory

    • newSAXParserFactory

      public static SAXParserFactory newSAXParserFactory()
      Creates a new SAXParserFactory, preferring the JDK's built-in implementation unless one is explicitly requested via the javax.xml.parsers.SAXParserFactory system property.
      Returns:
      a new SAXParserFactory

    • newSchemaFactory

      public static SchemaFactory newSchemaFactory()
      Creates a new SchemaFactory for W3C XML Schema, preferring the JDK's built-in implementation unless one is explicitly requested via the javax.xml.validation.SchemaFactory:http://www.w3.org/2001/XMLSchema system property.
      Returns:
      a new SchemaFactory