Class SAXDecoder

sax/src/main/java/feign/sax/SAXDecoder.java:56–179

Decodes responses using SAX, which is supported both in normal JVM environments, as well Android. Basic example with with Feign.Builder api = Feign.builder() .decoder(SAXDecoder.builder() .registerContentHandler(ContentHandlerForFoo.class) .registerCon

 * </pre>
 */
public class SAXDecoder implements Decoder {

  private final Map<Type, ContentHandlerWithResult.Factory<?>> handlerFactories;

  private SAXDecoder(Map<Type, ContentHandlerWithResult.Factory<?>> handlerFactories) {
    this.handlerFactories = handlerFactories;
  }

  public static Builder builder() {
    return new Builder();
  }

  @Override
  public Object decode(Response response, Type type) throws IOException, DecodeException {
    if (response.status() == 404 || response.status() == 204) return Util.emptyValueOf(type);
    if (response.body() == null) return null;
    ContentHandlerWithResult.Factory<?> handlerFactory = handlerFactories.get(type);
    checkState(
        handlerFactory != null,
        "type %s not in configured handlers %s",
        type,
        handlerFactories.keySet());
    ContentHandlerWithResult<?> handler = handlerFactory.create();
    try {
      XMLReader xmlReader = XMLReaderFactory.createXMLReader();
      xmlReader.setFeature("http://xml.org/sax/features/namespaces", false);
      xmlReader.setFeature("http://xml.org/sax/features/validation", false);
      /* Explicitly control sax configuration to prevent XXE attacks */
      xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
      xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
      xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
      xmlReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
      xmlReader.setContentHandler(handler);
      InputStream inputStream = response.body().asInputStream();
      try {
        xmlReader.parse(new InputSource(inputStream));
      } finally {
        ensureClosed(inputStream);
      }
      return handler.result();
    } catch (SAXException e) {
      throw new DecodeException(response.status(), e.getMessage(), response.request(), e);
    }
  }

  /** Implementations are not intended to be shared across requests. */
  public interface ContentHandlerWithResult<T> extends ContentHandler {

    /** expected to be set following a call to {@link XMLReader#parse(InputSource)} */
    T result();

    public interface Factory<T> {

      ContentHandlerWithResult<T> create();
    }
  }

  public static class Builder {