Updated limits and added thread safety to catalog

Author: rmraya

lib/xmljava.jar

@@ -57,7 +57,7 @@ public class Catalog implements EntityResolver2 {
     private Map<String, Catalog> delegateCatalogs;
     private String workDir;
     private String base = "";
-    private String documentParent = "";
+    private final ThreadLocal<String> documentParent = ThreadLocal.withInitial(() -> "");
     private String prefer = "public";
 
     protected Catalog(String catalogFile)
@@ -554,7 +554,7 @@ public String matchSystem(String baseURI, String systemId) {
             }
             // this resource is not in catalog.
 
-            if (!documentParent.isEmpty()) {
+            if (!documentParent.get().isEmpty()) {
                 // try to find the file in parent folder
                 File f = new File(systemId);
                 String name = f.getAbsolutePath();
@@ -566,14 +566,14 @@ public String matchSystem(String baseURI, String systemId) {
                         name = f.getName();
                     }
                 }
-                File parent = new File(documentParent);
+                File parent = new File(documentParent.get());
                 File file = new File(parent, name);
                 if (file.exists()) {
                     return file.getAbsolutePath();
                 }
             }
             try {
-                URI u = new URI(baseURI != null ? baseURI : documentParent).resolve(systemId).normalize();
+                URI u = new URI(baseURI != null ? baseURI : documentParent.get()).resolve(systemId).normalize();
                 File file = new File(u.toURL().toString());
                 if (file.exists()) {
                     return file.getAbsolutePath();
@@ -636,7 +636,7 @@ public String matchURI(String uri) {
     }
 
     public void currentDocumentBase(String parentFile) {
-        documentParent = parentFile;
+        documentParent.set(parentFile);
     }
 
     public String getDTD(String name) {

src/com/maxprograms/xml/Catalog.java

@@ -13,7 +13,7 @@
 public class Constants {
 
     public static final String VERSION = "5.0.0";
-    public static final String BUILD = "20260609_1150";
+    public static final String BUILD = "20260610_0723";
 
     private Constants() {
         // private for security

src/com/maxprograms/xml/Constants.java

@@ -79,6 +79,10 @@ public Document build(ByteArrayInputStream stream) throws SAXException, IOExcept
 			parser.setFeature("http://apache.org/xml/features/validation/dynamic", true);
 		}
 		parser.setProperty("http://www.oracle.com/xml/jaxp/properties/totalEntitySizeLimit", 0);
+		parser.setProperty("http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit", 0);
+		parser.setProperty("http://www.oracle.com/xml/jaxp/properties/maxParameterEntitySizeLimit", 0);
+		parser.setProperty("http://www.oracle.com/xml/jaxp/properties/maxGeneralEntitySizeLimit", 0);
+		parser.setProperty("http://www.oracle.com/xml/jaxp/properties/maxXMLNameLimit", 0);
 		boolean clearHandler = false;
 		if (contentHandler == null) {
 			contentHandler = new CustomContentHandler();
@@ -145,6 +149,10 @@ public Document build(URL url) throws SAXException, IOException, ParserConfigura
 			parser.setFeature("http://apache.org/xml/features/validation/dynamic", true);
 		}
 		parser.setProperty("http://www.oracle.com/xml/jaxp/properties/totalEntitySizeLimit", 0);
+		parser.setProperty("http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit", 0);
+		parser.setProperty("http://www.oracle.com/xml/jaxp/properties/maxParameterEntitySizeLimit", 0);
+		parser.setProperty("http://www.oracle.com/xml/jaxp/properties/maxGeneralEntitySizeLimit", 0);
+		parser.setProperty("http://www.oracle.com/xml/jaxp/properties/maxXMLNameLimit", 0);
 		boolean clearHandler = false;
 		if (contentHandler == null) {
 			contentHandler = new CustomContentHandler();