users@jersey.java.net

Re: [Jersey] Thread safety of XML-based factories <was> Re: [Jersey] Fixed <was> Re: [Jersey] Jersey vulnerable to XXE attack?

From: Paul Sandoz <Paul.Sandoz_at_Sun.COM>
Date: Mon, 13 Jul 2009 14:42:26 +0200

On Jul 13, 2009, at 2:26 PM, Martin Probst wrote:

>> Anyone know if SAXParserFactory, DocumentBuilderFactory and
>> XMLInputFactory
>> are thread safe?
>> The code currently assumes they are, but i am not sure i can assume
>> that.
>
> The JavaDoc for 1.4 used to explicitly state that
> DocumentBuilderFactory is _not_ thread safe, no idea why or how that
> was dropped. Looking at the code for Xerces, it should be thread safe,
> assuming you don't change any features after construction, and all the
> features you have set are thread safe (like resolvers). But that is of
> course hacking, you don't have any guarantee on that (which is pretty
> annoying).
>

Yes, i found the same information.

Given we are close to releasing i have taken the conservative step of
creating and storing factories in thread locals.

It should be possible to change this after the release if required.
For example, we can return factories that wrap and throw
UnsupportedOperationException for any state modifications.

Paul.