Add a context param to disallow DOCTYPE declarations #4134
Description
Currently, whether or not DOCTYPE declarations are allowed depends on the SAXParserFactory implementation in use. It would be good to add a context param to explicitly disallow/allow DOCTYPE declarations, as follows:
<context-param>
<param-name>com.sun.faces.disallowDoctypeDecl</param-name>
<param-value>true</param-value>
</context-param>
When this context param is set to true, this would set a feature on the SAX parser to disallow DOCTYPE declarations. When set to false, this would set a feature on the SAX parser to allow DOCTYPE declarations. When this context param is not specified, whether or not DOCTYPE declarations are allowed would just depend on the SAXParserFactory implementation in use, as is the case today.
As an example, for WildFly, we are considering switching to a SAXParserFactory implementation that disallows DOCTYPE declarations by default. Thus, this context param would allow users to override this default behaviour for individual JSF apps, if desired.
The following is a patch that adds this context param:
fjuma/mojarra-1@946cae9
Affected Versions
[2.2.13]