/*
    * This file is part of dependency-check-core.
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *     http://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   *
   * Copyright (c) 2016 Jeremy Long. All Rights Reserved.
   */
  package org.owasp.dependencycheck.utils;
  
  import java.io.InputStream;
  import javax.xml.XMLConstants;
  import javax.xml.parsers.DocumentBuilder;
  import javax.xml.parsers.DocumentBuilderFactory;
  import javax.xml.parsers.ParserConfigurationException;
  import javax.xml.parsers.SAXParser;
  import javax.xml.parsers.SAXParserFactory;
  import org.xml.sax.SAXException;
  import org.xml.sax.SAXNotRecognizedException;
  import org.xml.sax.SAXNotSupportedException;
  import org.xml.sax.SAXParseException;
  
  /**
   * Collection of XML related code.
   *
   * @author Jeremy Long
   */
  public final class XmlUtils {
  
      /**
       * JAXP Schema Language. Source:
       * http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html
       */
      public static final String JAXP_SCHEMA_LANGUAGE = "http://java.sun.com/xml/jaxp/properties/schemaLanguage";
      /**
       * W3C XML Schema. Source:
       * http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html
       */
      public static final String W3C_XML_SCHEMA = "http://www.w3.org/2001/XMLSchema";
      /**
       * JAXP Schema Source. Source:
       * http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html
       */
      public static final String JAXP_SCHEMA_SOURCE = "http://java.sun.com/xml/jaxp/properties/schemaSource";
  
      /**
       * Private constructor for a utility class.
       */
      private XmlUtils() {
      }
  
      /**
       * Constructs a validating secure SAX Parser.
       *
       * @param schemaStream the schema to validate the XML against
       * @return a SAX Parser
       * @throws ParserConfigurationException is thrown if there is a parser
       * configuration exception
       * @throws SAXNotRecognizedException thrown if there is an unrecognized
       * feature
       * @throws SAXNotSupportedException thrown if there is a non-supported
       * feature
       * @throws SAXException is thrown if there is a SAXException
       */
      public static SAXParser buildSecureSaxParser(InputStream schemaStream) throws ParserConfigurationException,
              SAXNotRecognizedException, SAXNotSupportedException, SAXException {
          final SAXParserFactory factory = SAXParserFactory.newInstance();
          factory.setNamespaceAware(true);
          factory.setValidating(true);
          factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
          factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
          //setting the following unfortunately breaks reading the old suppression files (version 1).
          //factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
  
          final SAXParser saxParser = factory.newSAXParser();
          saxParser.setProperty(JAXP_SCHEMA_LANGUAGE, W3C_XML_SCHEMA);
          saxParser.setProperty(JAXP_SCHEMA_SOURCE, schemaStream);
          return saxParser;
      }
  
      /**
       * Constructs a secure SAX Parser.
       *
       * @return a SAX Parser
       * @throws ParserConfigurationException thrown if there is a parser
       * configuration exception
       * @throws SAXNotRecognizedException thrown if there is an unrecognized
       * feature
       * @throws SAXNotSupportedException thrown if there is a non-supported
       * feature
      * @throws SAXException is thrown if there is a SAXException
      */
     public static SAXParser buildSecureSaxParser() throws ParserConfigurationException,
             SAXNotRecognizedException, SAXNotSupportedException, SAXException {
         final SAXParserFactory factory = SAXParserFactory.newInstance();
         factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
         factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
         return factory.newSAXParser();
     }
 
     /**
      * Constructs a new document builder with security features enabled.
      *
      * @return a new document builder
      * @throws ParserConfigurationException thrown if there is a parser
      * configuration exception
      */
     public static DocumentBuilder buildSecureDocumentBuilder() throws ParserConfigurationException {
         final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
         factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
         final DocumentBuilder db = factory.newDocumentBuilder();
         return db;
     }
 
     /**
      * Builds a prettier exception message.
      *
      * @param ex the SAXParseException
      * @return an easier to read exception message
      */
     public static String getPrettyParseExceptionInfo(SAXParseException ex) {
 
         final StringBuilder sb = new StringBuilder();
 
         if (ex.getSystemId() != null) {
             sb.append("systemId=").append(ex.getSystemId()).append(", ");
         }
         if (ex.getPublicId() != null) {
             sb.append("publicId=").append(ex.getPublicId()).append(", ");
         }
         if (ex.getLineNumber() > 0) {
             sb.append("Line=").append(ex.getLineNumber());
         }
         if (ex.getColumnNumber() > 0) {
             sb.append(", Column=").append(ex.getColumnNumber());
         }
         sb.append(": ").append(ex.getMessage());
 
         return sb.toString();
     }
 }