3.8.4 Using the functionality

(1) Changing limit values

You can use the following ways to change limit values of the secure processing functionality:

• Specifying system properties provided by Cosminexus XML Processor

• Specifying local properties provided by Cosminexus XML Processor

If both a system property and API-specific property are specified to change the value of the same item, the specification by the API-specific property prevails.

The following table lists the provided system properties.

Table 3‒15: List of provided system properties

No.	System property name	Description	Specifiable value#	Default value
1	com.cosminexus.jaxp.secure_processing.entityExpansionLimit	Number of times an entity reference is expanded	0 to 2147483647	100000
2	com.cosminexus.jaxp.secure_processing.maxGeneralEntitySizeLimit	String length of a general entity	0 to 2147483647	0
3	com.cosminexus.jaxp.secure_processing.maxParameterEntitySizeLimit	String length of a parameter entity	0 to 2147483647	1000000
4	com.cosminexus.jaxp.secure_processing.totalEntitySizeLimit	Total string length of expanded entities	0 to 2147483647	50000000
5	com.cosminexus.jaxp.secure_processing.maxOccurLimit	Number of nodes in the content model	0 to 2147483647	3000

The following table lists the provided local properties. The table also shows the values that can be specified for the local properties.

If an invalid value is specified, the value is not set. Therefore, the value that is set currently is not changed.

Table 3‒16: List of provided local properties

No.	Property name	Description
1	http://cosminexus.com/xml/properties/entityExpansionLimit	Number of times an entity reference is expanded
2	http://cosminexus.com/xml/properties/maxGeneralEntitySizeLimit	String length of a general entity
3	http://cosminexus.com/xml/properties/maxParameterEntitySizeLimit	String length of a parameter entity
4	http://cosminexus.com/xml/properties/totalEntitySizeLimit	Total string length of expanded entities
5	http://cosminexus.com/xml/properties/maxOccurLimit	Number of nodes in the content model

The following table lists the methods that are used to set the local properties listed in the preceding table.

Before you set the local properties, make sure that the secure processing functionality is enabled.

Table 3‒17: Methods for setting the local properties that set limit values

No.	Class name and interface name	Method
1	javax.xml.parsers.DocumentBuilderFactory	setAttribute
2	javax.xml.parsers.SAXParser	setProperty
3	org.xml.sax.XMLReader	setProperty
4	javax.xml.transform.TransformerFactory	setAttribute
5	javax.xml.validation.SchemaFactory	setProperty

In the com.cosminexus.jaxp.preparsedxml.PreparsedObjectFactory class, you cannot use local properties to set limit values. In this case, you must use system properties to set limit values.

To Page Top

(2) System property for compatibility

The system property for compatibility is provided so that the system behavior shown before this functionality was supported can be retained. The following table shows the specifications of the provided property. If an API-specific feature that enables this functionality is specified when this system property has been specified, the specification of the API-specific feature prevails.

Table 3‒18: System property for compatibility

System property name	Description	Value#
com.cosminexus.jaxp.secure_processing.compatible	The default settings in version 09-50-04 or later are used (see Table 3-14).	false (default)
	The default settings in version 09-50-03 or earlier are used.	true

To Page Top