xercesc/util/SecurityManager.hpp

0001 /*
0002  * Licensed to the Apache Software Foundation (ASF) under one or more
0003  * contributor license agreements.  See the NOTICE file distributed with
0004  * this work for additional information regarding copyright ownership.
0005  * The ASF licenses this file to You under the Apache License, Version 2.0
0006  * (the "License"); you may not use this file except in compliance with
0007  * the License.  You may obtain a copy of the License at
0008  *
0009  *      http://www.apache.org/licenses/LICENSE-2.0
0010  *
0011  * Unless required by applicable law or agreed to in writing, software
0012  * distributed under the License is distributed on an "AS IS" BASIS,
0013  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
0014  * See the License for the specific language governing permissions and
0015  * limitations under the License.
0016  */
0017
0018 /*
0019  * $Id$
0020  */
0021
0022 #if !defined(XERCESC_INCLUDE_GUARD_SECURITYMANAGER_HPP)
0023 #define XERCESC_INCLUDE_GUARD_SECURITYMANAGER_HPP
0024
0025 #include <xercesc/util/XercesDefs.hpp>
0026
0027 XERCES_CPP_NAMESPACE_BEGIN
0028
0029 /**
0030   * Allow application to force the parser to behave in a security-conscious
0031   * way.
0032   *
0033   * <p> There are cases in which an XML- or XmL-schema-
0034   * conformant processor can be presented with documents the
0035   * processing of which can involve the consumption of
0036   * prohibitive amounts of system resources.  Applications can
0037   * attach instances of this class to parsers that they've
0038   * created, via the
0039   * http://apache.org/xml/properties/security-manager property.
0040   * </p>
0041   *
0042   * <p> Defaults will be provided for all known security holes.
0043   * Setter methods will be provided on this class to ensure that
0044   * an application can customize each limit as it chooses.
0045   * Components that are vulnerable to any given hole need to be
0046   * written to act appropriately when an instance of this class
0047   * has been set on the calling parser.
0048   * </p>
0049   */
0050
0051 class XMLUTIL_EXPORT SecurityManager
0052 {
0053 public:
0054
0055     enum { ENTITY_EXPANSION_LIMIT = 50000};
0056
0057     /** @name default Constructors */
0058     //@{
0059     /** Default constructor */
0060     SecurityManager()
0061         : fEntityExpansionLimit((XMLSize_t)ENTITY_EXPANSION_LIMIT)
0062     {
0063     }
0064
0065     /** Destructor */
0066     virtual ~SecurityManager(){};
0067     //@}
0068
0069     /** @name The Security Manager */
0070     //@{
0071    /**
0072     * An application should call this method when it wishes to specify a particular
0073     * limit to the number of entity expansions the parser will permit in a
0074     * particular document.  The default behaviour should allow the parser
0075     * to validate nearly all XML non-malicious XML documents; if an
0076     * application knows that it is operating in a domain where entities are
0077     * uncommon, for instance, it may wish to provide a limit lower than the
0078     * parser's default.
0079     *
0080     * @param newLimit  the new entity expansion limit
0081     *
0082     */
0083     virtual void setEntityExpansionLimit(XMLSize_t newLimit)
0084     {
0085         fEntityExpansionLimit = newLimit;
0086     }
0087
0088    /**
0089     * Permits the application or a parser component to query the current
0090     * limit for entity expansions.
0091     *
0092     * @return   the current setting of the entity expansion limit
0093     *
0094     */
0095     virtual XMLSize_t getEntityExpansionLimit() const
0096     {
0097         return fEntityExpansionLimit;
0098     }
0099     //@}
0100
0101 protected:
0102     XMLSize_t fEntityExpansionLimit;
0103
0104 private:
0105
0106     /* Unimplemented Constructors and operators */
0107     /* Copy constructor */
0108     SecurityManager(const SecurityManager&);
0109
0110     /** Assignment operator */
0111     SecurityManager& operator=(const SecurityManager&);
0112 };
0113
0114 XERCES_CPP_NAMESPACE_END
0115
0116 #endif