How to stop loading external DTDs?

While using com.sun.org.apache.xerces parser, if XML has reference to external DTDs, it will be tried to load.
Exception will be thrown either network is not available or SocketPermission is not there.
Generally, this issue seen in JAVA Applet.

network: Cache entry not found [url: http://www.w3.org/TR/html4/strict.dtd, version: null]
network: Connecting http://www.w3.org/TR/html4/strict.dtd with proxy=HTTP 
network: Cache entry not found [url: http://www.w3.org:80/crossdomain.xml, version: null]
network: Connecting http://www.w3.org:80/crossdomain.xml with proxy=HTTP 
java.security.AccessControlException: access denied ("java.net.SocketPermission" "www.w3.org:80" "connect,resolve")
 at java.security.AccessControlContext.checkPermission(Unknown Source)
 at java.security.AccessController.checkPermission(Unknown Source)
 at java.lang.SecurityManager.checkPermission(Unknown Source)
 at java.lang.SecurityManager.checkConnect(Unknown Source)
 at sun.plugin2.applet.SecurityManagerHelper.checkConnectHelper(Unknown Source)
 at sun.plugin2.applet.AWTAppletSecurityManager.checkConnect(Unknown Source)
 at sun.net.www.http.HttpClient.openServer(Unknown Source)
 at sun.net.www.http.HttpClient.(Unknown Source)
 at sun.net.www.http.HttpClient.New(Unknown Source)
 at sun.net.www.http.HttpClient.New(Unknown Source)
 at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(Unknown Source)
 at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
 at sun.net.www.protocol.http.HttpURLConnection.connect(Unknown Source)
 at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityManager.setupCurrentEntity(Unknown Source)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityManager.startEntity(Unknown Source)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityManager.startDTDEntity(Unknown Source)
 at com.sun.org.apache.xerces.internal.impl.XMLDTDScannerImpl.setInputSource(Unknown Source)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$DTDDriver.dispatch(Unknown Source)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$DTDDriver.next(Unknown Source)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$PrologDriver.next(Unknown Source)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(Unknown Source)
 at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next(Unknown Source)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(Unknown Source)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(Unknown Source)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(Unknown Source)
 at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(Unknown Source)
 at com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(Unknown Source)
 at com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(Unknown Source

To overcome, set load-external-dtd feature to false.

DocumentBuilderFactory localDocumentBuilderFactory = DocumentBuilderFactory.newInstance();
localDocumentBuilderFactory.setNamespaceAware(true);
localDocumentBuilderFactory.setValidating(false);
 
localDocumentBuilderFactory.setFeature(
"http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

Posted in: DTD,xml

Reactions: