/* * Copyright (c) 2018-2028, DreamLu All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * Neither the name of the dreamlu.net developer nor the names of its * contributors may be used to endorse or promote products derived from * this software without specific prior written permission. * Author: DreamLu 卢春梦 (596392912@qq.com) */ package org.springblade.core.tool.utils; import org.springframework.lang.Nullable; import org.w3c.dom.Document; import org.w3c.dom.Element; import org.w3c.dom.Node; import org.w3c.dom.NodeList; import org.xml.sax.InputSource; import org.xml.sax.SAXException; import javax.xml.namespace.QName; import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; import javax.xml.xpath.XPath; import javax.xml.xpath.XPathConstants; import javax.xml.xpath.XPathExpressionException; import javax.xml.xpath.XPathFactory; import java.io.IOException; import java.io.InputStream; import java.io.StringReader; import java.util.HashMap; import java.util.Map; /** * xpath解析xml * *
 *     文档地址:
 *     http://www.w3school.com.cn/xpath/index.asp
 * 
* * @author L.cm */ public class XmlUtil { private final XPath path; private final Document doc; private XmlUtil(InputSource inputSource) throws ParserConfigurationException, SAXException, IOException { DocumentBuilderFactory dbf = getDocumentBuilderFactory(); DocumentBuilder db = dbf.newDocumentBuilder(); doc = db.parse(inputSource); path = getXPathFactory().newXPath(); } /** * 创建工具类 * * @param inputSource inputSource * @return XmlUtil */ private static XmlUtil create(InputSource inputSource) { try { return new XmlUtil(inputSource); } catch (ParserConfigurationException | SAXException | IOException e) { throw Exceptions.unchecked(e); } } /** * 转换工具类 * * @param inputStream inputStream * @return XmlUtil */ public static XmlUtil of(InputStream inputStream) { InputSource inputSource = new InputSource(inputStream); return create(inputSource); } /** * 转换工具类 * * @param xmlStr xmlStr * @return XmlUtil */ public static XmlUtil of(String xmlStr) { StringReader sr = new StringReader(xmlStr.trim()); InputSource inputSource = new InputSource(sr); XmlUtil xmlUtil = create(inputSource); IoUtil.closeQuietly(sr); return xmlUtil; } /** * 转换路径 * * @param expression 表达式 * @param item 实体 * @param returnType 返回类型 * @return Object */ private Object evalXPath(String expression, @Nullable Object item, QName returnType) { item = null == item ? doc : item; try { return path.evaluate(expression, item, returnType); } catch (XPathExpressionException e) { throw Exceptions.unchecked(e); } } /** * 获取String * * @param expression 路径 * @return {String} */ public String getString(String expression) { return (String) evalXPath(expression, null, XPathConstants.STRING); } /** * 获取Boolean * * @param expression 路径 * @return {String} */ public Boolean getBoolean(String expression) { return (Boolean) evalXPath(expression, null, XPathConstants.BOOLEAN); } /** * 获取Number * * @param expression 路径 * @return {Number} */ public Number getNumber(String expression) { return (Number) evalXPath(expression, null, XPathConstants.NUMBER); } /** * 获取某个节点 * * @param expression 路径 * @return {Node} */ public Node getNode(String expression) { return (Node) evalXPath(expression, null, XPathConstants.NODE); } /** * 获取子节点 * * @param expression 路径 * @return NodeList */ public NodeList getNodeList(String expression) { return (NodeList) evalXPath(expression, null, XPathConstants.NODESET); } /** * 获取String * * @param node 节点 * @param expression 相对于node的路径 * @return {String} */ public String getString(Object node, String expression) { return (String) evalXPath(expression, node, XPathConstants.STRING); } /** * 获取 * * @param node 节点 * @param expression 相对于node的路径 * @return {String} */ public Boolean getBoolean(Object node, String expression) { return (Boolean) evalXPath(expression, node, XPathConstants.BOOLEAN); } /** * 获取 * * @param node 节点 * @param expression 相对于node的路径 * @return {Number} */ public Number getNumber(Object node, String expression) { return (Number) evalXPath(expression, node, XPathConstants.NUMBER); } /** * 获取某个节点 * * @param node 节点 * @param expression 路径 * @return {Node} */ public Node getNode(Object node, String expression) { return (Node) evalXPath(expression, node, XPathConstants.NODE); } /** * 获取子节点 * * @param node 节点 * @param expression 相对于node的路径 * @return NodeList */ public NodeList getNodeList(Object node, String expression) { return (NodeList) evalXPath(expression, node, XPathConstants.NODESET); } /** * 针对没有嵌套节点的简单处理 * * @return map集合 */ public Map toMap() { Element root = doc.getDocumentElement(); Map params = new HashMap<>(16); // 将节点封装成map形式 NodeList list = root.getChildNodes(); for (int i = 0; i < list.getLength(); i++) { Node node = list.item(i); if (node instanceof Element) { params.put(node.getNodeName(), node.getTextContent()); } } return params; } private static volatile boolean preventedXXE = false; private static DocumentBuilderFactory getDocumentBuilderFactory() throws ParserConfigurationException { DocumentBuilderFactory dbf = XmlUtil.XmlHelperHolder.documentBuilderFactory; if (!preventedXXE) { preventXXE(dbf); } return dbf; } /** * preventXXE * * @param dbf * @throws ParserConfigurationException */ private static void preventXXE(DocumentBuilderFactory dbf) throws ParserConfigurationException { // This is the PRIMARY defense. If DTDs (doctypes) are disallowed, almost all XML entity attacks are prevented // Xerces 2 only - http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); // If you can't completely disable DTDs, then at least do the following: // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities // JDK7+ - http://xml.org/sax/features/external-general-entities dbf.setFeature("http://xml.org/sax/features/external-general-entities", false); // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities // JDK7+ - http://xml.org/sax/features/external-parameter-entities dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); // Disable external DTDs as well dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); // and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks" dbf.setXIncludeAware(false); dbf.setExpandEntityReferences(false); preventedXXE = true; } private static XPathFactory getXPathFactory() { return XmlUtil.XmlHelperHolder.xPathFactory; } /** * 内部类单例 */ private static class XmlHelperHolder { private static DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); private static XPathFactory xPathFactory = XPathFactory.newInstance(); } }