users@jersey.java.net

Re: [Jersey] Thread safety of XML-based factories <was> Re: [Jersey] Fixed <was> Re: [Jersey] Jersey vulnerable to XXE attack?

From: Martin Probst <mail_at_martin-probst.com>
Date: Mon, 13 Jul 2009 14:26:59 +0200

> Anyone know if SAXParserFactory, DocumentBuilderFactory and XMLInputFactory
> are thread safe?
> The code currently assumes they are, but i am not sure i can assume that.

The JavaDoc for 1.4 used to explicitly state that
DocumentBuilderFactory is _not_ thread safe, no idea why or how that
was dropped. Looking at the code for Xerces, it should be thread safe,
assuming you don't change any features after construction, and all the
features you have set are thread safe (like resolvers). But that is of
course hacking, you don't have any guarantee on that (which is pretty
annoying).

Martin