SecureSchemaFactory (Apache Commons Secure XML 1.0.0 API)
Description: declaration: package: org.apache.commons.xml.secure, class: SecureSchemaFactory

Package org.apache.commons.xml.secure

# Class SecureSchemaFactory

java.lang.Object
org.apache.commons.xml.secure.SecureSchemaFactory

public final class SecureSchemaFactory extends Object
Creates new, secure `SchemaFactory` instances.

Beyond the three universal guarantees on `org.apache.commons.xml.secure`:

- `xs:import`, `xs:include` and `xs:redefine` schemaLocation URIs are not resolved during schema compilation,
- `xsi:schemaLocation` / `xsi:noNamespaceSchemaLocation` hints in instance documents are not resolved during validation, and
- the content model a schema expands into is bounded, on every implementation offering a limit for it. A loader expands a repeated particle while building the DFA, so a compact schema carrying a large `maxOccurs` would otherwise exhaust memory or CPU (see Xerces' security manager, which caps that expansion at 3,000 nodes).

The same guarantees apply to `Validator` and `ValidatorHandler` instances produced from the resulting `Schema`.

This class is not itself a `SchemaFactory`, so it inherits none of the static JAXP factory methods. A caller therefore cannot obtain an unsecured factory through this class by calling a method such as `newDefaultInstance()`. The secure factories are instances of a nested, non-public wrapper class.

See Also:
  - `org.apache.commons.xml.secure`

- ## Method Summary

  Modifier and Type
  Method
  Description
  `static SchemaFactory`
  `newDefaultInstance()`
  Returns a new, secure `SchemaFactory` of the system-default implementation, supporting W3C XML Schema 1.0.
  `static SchemaFactory`
  `newInstance(String schemaLanguage)`
  Returns a new, secure `SchemaFactory` for the given schema language.
  `static SchemaFactory`
  `newInstance(String schemaLanguage, String factoryClassName, ClassLoader classLoader)`
  Returns a new, secure `SchemaFactory` of the given implementation class.

  ### Methods inherited from class java.lang.Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- ## Method Details

  - ### newDefaultInstance

    public static SchemaFactory newDefaultInstance()
    Returns a new, secure `SchemaFactory` of the system-default implementation, supporting W3C XML Schema 1.0.

    Obtained from `SchemaFactory.newDefaultInstance()` where the platform provides it (Java 9 or later), by instantiating the JDK's built-in implementation directly on Java 8, and by the standard `newInstance(String)` lookup where the platform provides neither (for example Android, whose lookup falls back to exactly the Xerces implementation this library recognizes).

    Returns:
      A secure factory.
    Throws:
      `IllegalStateException` - Thrown if a required secure setting cannot be applied to the underlying implementation.
      `IllegalArgumentException` - Thrown from the `newInstance(String)` lookup this method falls back to on a platform that provides neither `newDefaultInstance()` nor the JDK's built-in implementation (for example Android).

  - ### newInstance

    public static SchemaFactory newInstance(String schemaLanguage)
    Returns a new, secure `SchemaFactory` for the given schema language.
    Parameters:
      `schemaLanguage` - The schema language, as accepted by `SchemaFactory.newInstance(String)`.
    Returns:
      A secure factory.
    Throws:
      `IllegalArgumentException` - Thrown if no implementation of the schema language is available.
      `NullPointerException` - Thrown if `schemaLanguage` is `null`.
      `SchemaFactoryConfigurationError` - Thrown if a configuration error is encountered.

  - ### newInstance

    public static SchemaFactory newInstance(String schemaLanguage, String factoryClassName, ClassLoader classLoader)
    Returns a new, secure `SchemaFactory` of the given implementation class.
    Parameters:
      `schemaLanguage` - The schema language, as accepted by `SchemaFactory.newInstance(String)`.
      `factoryClassName` - The fully qualified class name of the `SchemaFactory` implementation.
      `classLoader` - The class loader used to load the factory class; `null` means the current thread's context class loader.
    Returns:
      A secure factory.
    Throws:
      `IllegalArgumentException` - Thrown if `factoryClassName` is `null`, or if the factory class cannot be loaded or instantiated, or does not support `schemaLanguage`.
      `NullPointerException` - Thrown if `schemaLanguage` is `null`.