{"record":{"id":"e09f700c450febb2","repo":"jeecgboot/JeecgBoot","slug":"unable-to-create-xmlreader","errorCode":null,"errorMessage":"Unable to create XMLReader","messagePattern":"Unable to create XMLReader","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/cas/util/XmlUtils.java","lineNumber":85,"sourceCode":"     * Get an instance of an XML reader from the XMLReaderFactory.\n     *\n     * @return the XMLReader.\n     */\n    public static XMLReader getXmlReader() {\n        try {\n            //update-begin---author:wangshuai---date:2026-03-30---for:【issues/9422】XmlUtils.extractCustomAttributes可能存在疑似的外部实体依赖漏洞---\n            final SAXParserFactory spf = SAXParserFactory.newInstance();\n            spf.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n            spf.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n            spf.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n            spf.setFeature(\"http://apache.org/xml/features/nonvalidating/load-external-dtd\", false);\n            final XMLReader reader = spf.newSAXParser().getXMLReader();\n            //update-end---author:wangshuai---date:2026-03-30---for:【issues/9422】XmlUtils.extractCustomAttributes可能存在疑似的外部实体依赖漏洞---\n            reader.setFeature(\"http://xml.org/sax/features/namespaces\", true);\n            reader.setFeature(\"http://xml.org/sax/features/namespace-prefixes\", false);\n            return reader;\n        } catch (final Exception e) {\n            throw new RuntimeException(\"Unable to create XMLReader\", e);\n        }\n    }\n\n\n    /**\n     * Retrieve the text for a group of elements. Each text element is an entry\n     * in a list.\n     * <p>This method is currently optimized for the use case of two elements in a list.\n     *\n     * @param xmlAsString the xml response\n     * @param element     the element to look for\n     * @return the list of text from the elements.\n     */\n    public static List<String> getTextForElements(final String xmlAsString, final String element) {\n        final List<String> elements = new ArrayList<String>(2);\n        final XMLReader reader = getXmlReader();\n\n        final DefaultHandler handler = new DefaultHandler() {","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/cas/util/XmlUtils.java#L67-L103","documentation":"XmlUtils.getXmlReader() builds a hardened SAXParserFactory (disallow-doctype-decl, external general/parameter entities off, load-external-dtd off) and obtains an XMLReader. Any failure creating the parser/reader is wrapped as RuntimeException 'Unable to create XMLReader'.","triggerScenarios":"JAXP misconfiguration; a conflicting/stale XML parser (xerces/saxon/aalto) on the classpath; the JRE blocks the feature; security manager restrictions; shaded jar breaking ServiceLoader.","commonSituations":"Dependency brings an incompatible stax/sax impl; restricted server JRE; classpath shading reordered SPI providers.","solutions":["Inspect the wrapped cause in the RuntimeException.","Check the classpath for conflicting XML parsers (mvn dependency:tree | grep -i xml).","Verify the JAXP factory resolves (System property javax.xml.parsers.SAXParserFactory overrides).","Test on a clean classpath to isolate a dependency conflict."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// validate the JAXP factory is resolvable at startup\nSAXParserFactory f = SAXParserFactory.newInstance();\nf.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\nXMLReader r = f.newSAXParser().getXMLReader();","typeGuard":null,"tryCatchPattern":"try {\n    return spf.newSAXParser().getXMLReader();\n} catch (Exception e) {\n    log.error(\"无法创建 XMLReader，检查 classpath XML 解析器冲突\", e);\n    throw new RuntimeException(\"Unable to create XMLReader\", e);\n}","preventionTips":["Run mvn dependency:tree and remove duplicate XML parser implementations.","Don't override javax.xml.parsers.SAXParserFactory unless necessary.","Validate parser creation in a startup smoke test."],"tags":["xml","sax","jaxp","configuration","classpath"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}