fix code quality as reported by Github CodeQL

content-core/src/main/java/org/xbib/content/io/BytesStreamInput.java

@@ -3,14 +3,13 @@ package org.xbib.content.io;
 import java.io.IOException;
 import java.io.InputStream;
 
-/**
- *
- */
 public class BytesStreamInput extends InputStream {
 
-    private byte[] buf;
+    private final byte[] buf;
-    private int pos;
+
-    private int count;
+    private final int count;
+
+    private long pos;
 
     public BytesStreamInput(byte[] buf) {
         this(buf, 0, buf.length);
@@ -37,7 +36,8 @@ public class BytesStreamInput extends InputStream {
 
     @Override
     public int read() throws IOException {
-        return pos < count ? buf[pos++] & 0xff : -1;
+        int i = (int) pos++;
+        return pos < count ? buf[i] & 0xff : -1;
     }
 
     @Override
@@ -48,21 +48,21 @@ public class BytesStreamInput extends InputStream {
         if (pos >= count) {
             return -1;
         }
-        int l = len;
+        long l = len;
         if (pos + l > count) {
             l = count - pos;
         }
         if (l <= 0) {
             return 0;
         }
-        System.arraycopy(buf, pos, b, off, l);
+        System.arraycopy(buf, (int) pos, b, off, (int) l);
         pos += l;
-        return l;
+        return (int) l;
     }
 
     @Override
     public void reset() throws IOException {
-        pos = 0;
+        pos = 0L;
     }
 
     @Override

content-rdf/src/main/java/org/xbib/content/rdf/io/sink/CharOutputSink.java

@@ -13,13 +13,18 @@ import java.nio.charset.Charset;
 public final class CharOutputSink implements CharSink {
 
     private static final short BATCH_SIZE = 256;
+
     private final Charset charset;
+
     private Writer writer;
+
     private OutputStream outputStream;
+
     private boolean closeOnEndStream;
+
     private StringBuilder buffer;
 
-    private short bufferSize;
+    private long bufferSize;
 
     /**
      * Creates class instance with default charset encoding.

content-rdf/src/main/java/org/xbib/content/rdf/io/source/XmlSource.java

@@ -1,5 +1,7 @@
 package org.xbib.content.rdf.io.source;
 
+import java.nio.charset.StandardCharsets;
+import javax.xml.XMLConstants;
 import org.xbib.content.rdf.io.sink.XmlSink;
 import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
@@ -9,35 +11,40 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.Reader;
-import java.nio.charset.Charset;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
 import javax.xml.parsers.SAXParserFactory;
 
 final class XmlSource extends AbstractSource<XmlSink> {
 
-    private XMLReader xmlReader = null;
+    private XMLReader xmlReader;
 
     XmlSource(XmlSink sink) {
         super(sink);
+        try {
+            SAXParserFactory parserFactory = SAXParserFactory.newInstance();
+            parserFactory.setFeature("http://xml.org/sax/features/namespaces", true);
+            parserFactory.setFeature("http://xml.org/sax/features/namespace-prefixes", true);
+            parserFactory.setFeature("http://xml.org/sax/features/validation", false);
+            parserFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            parserFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+            parserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-dtd-grammar", false);
+            parserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            parserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            parserFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            parserFactory.setXIncludeAware(false);
+            SAXParser saxParser = parserFactory.newSAXParser();
+            setXmlReader(saxParser.getXMLReader());
+        } catch (ParserConfigurationException | SAXException e) {
+            throw new IllegalArgumentException(e);
         }
-
-    public static XMLReader getDefaultXmlReader() throws SAXException, ParserConfigurationException {
-        SAXParserFactory factory = SAXParserFactory.newInstance();
-        factory.setNamespaceAware(true);
-        factory.setValidating(false);
-        SAXParser parser = factory.newSAXParser();
-        return parser.getXMLReader();
     }
 
     @Override
     public void process(Reader reader, String mimeType, String baseUri) throws IOException {
         try {
-            initXmlReader();
+            xmlReader.setContentHandler(sink);
-        } catch (SAXException | ParserConfigurationException e) {
+            xmlReader.setProperty("http://xml.org/sax/properties/lexical-handler", sink);
-            throw new IOException("can not instantinate XMLReader", e);
-        }
-        try {
             sink.setBaseUri(baseUri);
             xmlReader.parse(new InputSource(reader));
         } catch (SAXException e) {
@@ -52,24 +59,12 @@ final class XmlSource extends AbstractSource<XmlSink> {
 
     @Override
     public void process(InputStream inputStream, String mimeType, String baseUri) throws IOException {
-        try (Reader reader = new InputStreamReader(inputStream, Charset.forName("UTF-8"))) {
+        try (Reader reader = new InputStreamReader(inputStream, StandardCharsets.UTF_8)) {
             process(reader, mimeType, baseUri);
         }
     }
 
-    private void initXmlReader() throws SAXException, ParserConfigurationException {
-        if (xmlReader == null) {
-            xmlReader = getDefaultXmlReader();
-        }
-        xmlReader.setContentHandler(sink);
-        xmlReader.setProperty("http://xml.org/sax/properties/lexical-handler", sink);
-    }
-
     public void setXmlReader(XMLReader xmlReader) throws SAXException, ParserConfigurationException {
-        if (xmlReader == null) {
-            this.xmlReader = getDefaultXmlReader();
-        } else {
         this.xmlReader = xmlReader;
     }
 }
-}

content-rdf/src/test/java/org/xbib/content/rdf/IRITest.java

@@ -7,11 +7,28 @@ import org.junit.jupiter.api.Test;
 import org.xbib.content.resource.IRI;
 import org.xbib.content.resource.IRISyntaxException;
 
-/**
- *
- */
 public class IRITest {
 
+    @Test
+    public void testUserInfo() {
+        IRI iri = IRI.create("http://localhost");
+        assertNull(iri.getUserInfo());
+        assertEquals("localhost", iri.getHost());
+        assertEquals(-1, iri.getPort());
+        iri = IRI.create("http://user@localhost");
+        assertEquals("user", iri.getUserInfo());
+        assertEquals("localhost", iri.getHost());
+        assertEquals(-1, iri.getPort());
+        iri = IRI.create("http://user:password@localhost");
+        assertEquals("user:password", iri.getUserInfo());
+        assertEquals("localhost", iri.getHost());
+        assertEquals(-1, iri.getPort());
+        iri = IRI.create("http://user:password@localhost:1234");
+        assertEquals("user:password", iri.getUserInfo());
+        assertEquals("localhost", iri.getHost());
+        assertEquals(1234, iri.getPort());
+    }
+
     @Test
     public void testJsonLd() {
         IRI iri = IRI.create("@context");

content-rdf/src/test/java/org/xbib/content/rdf/RouteRdfXContentBuilderTest.java

@@ -12,13 +12,7 @@ import org.xbib.content.resource.IRI;
 
 import java.io.IOException;
 import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.StringReader;
-import java.nio.charset.StandardCharsets;
 
-/**
- *
- */
 public class RouteRdfXContentBuilderTest {
 
     @Test
@@ -57,7 +51,7 @@ public class RouteRdfXContentBuilderTest {
                     sb.append(builder.string());
                 })
                 .parse();
-        assertStream(new InputStreamReader(getClass().getResourceAsStream("viaf.json"), StandardCharsets.UTF_8),
+        assertStream("viaf.json", getClass().getResourceAsStream("viaf.json"),
-                new StringReader(sb.toString()));
+                sb.toString());
     }
 }

content-rdf/src/test/java/org/xbib/content/rdf/StreamTester.java

@@ -1,55 +1,62 @@
 package org.xbib.content.rdf;
 
-import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.fail;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
 import java.io.InputStream;
-import java.io.Reader;
+import java.nio.ByteBuffer;
+import java.nio.channels.Channels;
+import java.nio.channels.ReadableByteChannel;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
 
-/**
- *
- */
 public class StreamTester {
 
-    public static void assertStream(InputStream expected, InputStream actual) {
+    public static void assertStream(String name, Path path1, Path path2) throws IOException {
-        int offset = 0;
+        assertStream(name, Files.newInputStream(path1), Files.newInputStream(path2));
-        try {
-            while (true) {
-                final int exp = expected.read();
-                if (exp == -1) {
-                    assertEquals(-1, actual.read());
-                    break;
-                } else {
-                    final int act = actual.read();
-                    assertEquals(exp, act);
-                }
-                offset++;
-            }
-            expected.close();
-            actual.close();
-        } catch (Exception e) {
-            fail("Exception at offset " + offset + ": " + e);
-        }
     }
 
-    protected static void assertStream(Reader expected, Reader actual) {
+    public static void assertStream(String name, Path path, InputStream expected) throws IOException {
-        int offset = 0;
+        assertStream(name, expected, Files.newInputStream(path));
-        try {
-            while (true) {
-                final int exp = expected.read();
-                if (exp == -1) {
-                    assertEquals(-1, actual.read(), "Expecting end of actual stream at offset " + offset);
-                    break;
-                } else {
-                    final int act = actual.read();
-                    assertEquals(exp, act, "Expecting same data at offset " + offset);
-                }
-                offset++;
-            }
-            expected.close();
-            actual.close();
-        } catch (Exception e) {
-            fail("Exception at offset " + offset + ": " + e);
-        }
     }
 
+    public static void assertStream(String name, InputStream expected, String actual) throws IOException {
+        assertStream(name, expected, new ByteArrayInputStream(actual.getBytes(StandardCharsets.UTF_8)));
+    }
+
+    public static void assertStream(String name, InputStream expected, InputStream actual) throws IOException {
+        int offset = 0;
+        try (ReadableByteChannel ch1 = Channels.newChannel(expected);
+             ReadableByteChannel ch2 = Channels.newChannel(actual)) {
+            ByteBuffer buf1 = ByteBuffer.allocateDirect(4096);
+            ByteBuffer buf2 = ByteBuffer.allocateDirect(4096);
+            while (true) {
+                int n1 = ch1.read(buf1);
+                int n2 = ch2.read(buf2);
+                if (n1 == -1 || n2 == -1) {
+                    if (n1 != n2) {
+                        fail(name + ": stream length mismatch: " + n1 + " != " + n2 + " offset=" + offset);
+                    } else {
+                        return;
+                    }
+                }
+                buf1.flip();
+                buf2.flip();
+                for (int i = 0; i < Math.min(n1, n2); i++) {
+                    int b1 = buf1.get() & 0xFF;
+                    int b2 = buf2.get() & 0xFF;
+                    if (b1 != b2) {
+                        fail(name + ": mismatch at offset " + (offset + i)
+                                + " (" + Integer.toHexString(b1)
+                                + " != " + Integer.toHexString(b2) + ")"
+                        );
+                    }
+                }
+                buf1.compact();
+                buf2.compact();
+                offset += Math.min(n1, n2);
+            }
+        }
+    }
 }

content-rdf/src/test/java/org/xbib/content/rdf/io/rdfxml/EuropeanaEDMReaderTest.java

@@ -20,9 +20,6 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.util.Iterator;
 
-/**
- *
- */
 public class EuropeanaEDMReaderTest extends StreamTester {
 
     private static final IRI GEO_LAT = IRI.create("http://www.w3.org/2003/01/geo/wgs84_pos#lat");
@@ -47,8 +44,7 @@ public class EuropeanaEDMReaderTest extends StreamTester {
             Resource resource = resourceIterator.next();
             builder.receive(resource);
         }
-        //System.err.println(builder.string());
+        assertStream("edm.nt", getClass().getResource("edm.nt").openStream(),
-        assertStream(getClass().getResource("edm.nt").openStream(),
                 builder.streamInput());
     }
 

content-rdf/src/test/java/org/xbib/content/rdf/io/rdfxml/GNDRdfXmlReaderTest.java

@@ -10,12 +10,7 @@ import org.xbib.content.resource.IRINamespaceContext;
 import org.xbib.content.rdf.StreamTester;
 
 import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.StringReader;
 
-/**
- *
- */
 public class GNDRdfXmlReaderTest extends StreamTester {
 
     @Test
@@ -28,8 +23,7 @@ public class GNDRdfXmlReaderTest extends StreamTester {
         reader.setRdfContentBuilderProvider(() -> turtleBuilder(params));
         reader.setRdfContentBuilderHandler(builder -> sb.append(builder.string()));
         reader.parse();
-        assertStream(new InputStreamReader(getClass().getResourceAsStream("gnd.ttl")),
+        assertStream("gnd.ttl", getClass().getResourceAsStream("gnd.ttl"), sb.toString());
-                new StringReader(sb.toString()));
     }
 
     @Test
@@ -42,8 +36,7 @@ public class GNDRdfXmlReaderTest extends StreamTester {
         reader.setRdfContentBuilderProvider(() -> turtleBuilder(params));
         reader.setRdfContentBuilderHandler(builder -> sb.append(builder.string()));
         reader.parse();
-        assertStream(new InputStreamReader(getClass().getResourceAsStream("gnd.ttl")),
+        assertStream("gnd.ttl", getClass().getResourceAsStream("gnd.ttl"), sb.toString());
-                new StringReader(sb.toString()));
     }
 
     @Test
@@ -55,8 +48,7 @@ public class GNDRdfXmlReaderTest extends StreamTester {
         reader.setRdfContentBuilderProvider(RdfContentFactory::ntripleBuilder);
         reader.setRdfContentBuilderHandler(builder -> sb.append(builder.string()));
         reader.parse();
-        assertStream(new InputStreamReader(getClass().getResourceAsStream("GND.nt")),
+        assertStream("GND.nt", getClass().getResourceAsStream("GND.nt"), sb.toString());
-                new StringReader(sb.toString()));
     }
 
 }

content-rdf/src/test/java/org/xbib/content/rdf/io/rdfxml/RdfXmlReaderTest.java

@@ -9,13 +9,7 @@ import org.xbib.content.resource.IRINamespaceContext;
 import org.xbib.content.rdf.StreamTester;
 
 import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.StringReader;
-import java.nio.charset.StandardCharsets;
 
-/**
- *
- */
 public class RdfXmlReaderTest extends StreamTester {
 
     @Test
@@ -29,8 +23,6 @@ public class RdfXmlReaderTest extends StreamTester {
         reader.setRdfContentBuilderProvider(() -> turtleBuilder(params));
         reader.setRdfContentBuilderHandler(builder -> sb.append(builder.string()));
         reader.parse();
-        assertStream(new InputStreamReader(getClass().getResourceAsStream("118540238.ttl"), StandardCharsets.UTF_8),
+        assertStream("118540238.ttl", getClass().getResourceAsStream("118540238.ttl"), sb.toString());
-                new StringReader(sb.toString()));
     }
-
 }

content-rdf/src/test/java/org/xbib/content/rdf/io/rdfxml/VIAFRdfXmlReaderTest.java

@@ -9,12 +9,7 @@ import org.xbib.content.rdf.StreamTester;
 
 import java.io.IOException;
 import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.StringReader;
 
-/**
- *
- */
 public class VIAFRdfXmlReaderTest extends StreamTester {
 
     @Test
@@ -29,7 +24,6 @@ public class VIAFRdfXmlReaderTest extends StreamTester {
                 .setRdfContentBuilderProvider(() -> turtleBuilder(params))
                 .setRdfContentBuilderHandler(builder -> sb.append(builder.string()))
                 .parse();
-        assertStream(new InputStreamReader(getClass().getResource("viaf.ttl").openStream()),
+        assertStream("viaf.ttl", getClass().getResource("viaf.ttl").openStream(), sb.toString());
-                new StringReader(sb.toString()));
     }
 }

content-rdf/src/test/java/org/xbib/content/rdf/io/turtle/TurtleTest.java

@@ -110,7 +110,7 @@ public class TurtleTest extends StreamTester {
         TurtleContentParams params = new TurtleContentParams(context, false);
         RdfContentBuilder<TurtleContentParams> builder = turtleBuilder(params);
         builder.receive(resource);
-        assertStream(getClass().getResource("turtle-test.ttl").openStream(), builder.streamInput());
+        assertStream("turtle-test.ttl", getClass().getResource("turtle-test.ttl").openStream(), builder.streamInput());
     }
 
     private Resource createResource2() {
@@ -142,7 +142,7 @@ public class TurtleTest extends StreamTester {
         TurtleContentParams params = new TurtleContentParams(IRINamespaceContext.getInstance(), false);
         RdfContentBuilder<TurtleContentParams> builder = turtleBuilder(params);
         builder.receive(resource);
-        assertStream(getClass().getResourceAsStream("turtle-indent.ttl"),
+        assertStream("turtle-indent.ttl", getClass().getResourceAsStream("turtle-indent.ttl"),
                 builder.streamInput());
     }
 
@@ -180,7 +180,7 @@ public class TurtleTest extends StreamTester {
         TurtleContentParams params = new TurtleContentParams(IRINamespaceContext.getInstance(), false);
         RdfContentBuilder<TurtleContentParams> builder = turtleBuilder(params);
         builder.receive(resource);
-        assertStream(getClass().getResourceAsStream("deep-nested.ttl"),
+        assertStream("deep-nested.ttl", getClass().getResourceAsStream("deep-nested.ttl"),
                 builder.streamInput());
     }
 

content-rdf/src/test/java/org/xbib/content/rdf/io/xml/OAITest.java

@@ -75,6 +75,6 @@ public class OAITest extends StreamTester {
         XmlContentParser<TurtleContentParams> parser = new XmlContentParser<>(in);
         parser.builder(builder);
         parser.setHandler(xmlHandler).parse();
-        assertStream(getClass().getResourceAsStream("oai.ttl"), builder.streamInput());
+        assertStream("oai.ttl", getClass().getResourceAsStream("oai.ttl"), builder.streamInput());
     }
 }

content-rdf/src/test/java/org/xbib/content/rdf/io/xml/XmlReaderTest.java

@@ -86,7 +86,7 @@ public class XmlReaderTest extends StreamTester {
         new XmlContentParser<TurtleContentParams>(in)
                 .setHandler(xmlHandler)
                 .parse();
-        assertStream(getClass().getResource("dc.ttl").openStream(),
+        assertStream("dc.ttl", getClass().getResource("dc.ttl").openStream(),
                 builder.streamInput());
     }
 

content-resource/src/main/java/org/xbib/content/resource/IRI.java

@@ -17,16 +17,11 @@ import java.nio.charset.StandardCharsets;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-/**
- *
- */
 public class IRI implements Comparable<IRI>, Node {
 
     private static final SchemeRegistry registry = SchemeRegistry.getInstance();
     private static final Pattern IRIPATTERN =
             Pattern.compile("^(?:([^:/?#]+):)?(?://([^/?#]*))?([^?#]*)(?:\\?([^#]*))?(?:#(.*))?");
-    private static final Pattern AUTHORITYPATTERN =
-            Pattern.compile("^(?:(.*)?@)?((?:\\[.*\\])|(?:[^:]*))?(?::(\\d+))?");
     private Scheme schemeClass;
     private String scheme;
     private String schemeSpecificPart;
@@ -552,16 +547,13 @@ public class IRI implements Comparable<IRI>, Node {
 
     private void parseAuthority() {
         if (authority != null) {
-            Matcher auth = AUTHORITYPATTERN.matcher(authority);
+            // [ <userinfo> '@' ] <host> [ ':' <port> ]
-            if (auth.find()) {
+            int pos = authority.lastIndexOf('@');
-                userinfo = auth.group(1);
+            userinfo = pos >= 0 ? authority.substring(0, pos) : null;
-                host = auth.group(2);
+            String s = pos >= 0 ? authority.substring(pos + 1) : authority;
-                if (auth.group(3) != null) {
+            pos = s.indexOf(':');
-                    port = Integer.parseInt(auth.group(3));
+            host = pos >= 0 ? s.substring(0, pos) : s;
-                } else {
+            port = pos >= 0 ? Integer.parseInt(s.substring(pos + 1)) : -1;
-                    port = -1;
-                }
-            }
             try {
                 CharUtils.verify(userinfo, Profile.IUSERINFO);
                 CharUtils.verify(host, Profile.IHOST);

content-xml/src/main/java/org/xbib/content/xml/util/XMLFilterReader.java

@@ -1,5 +1,6 @@
 package org.xbib.content.xml.util;
 
+import javax.xml.XMLConstants;
 import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
 import org.xml.sax.SAXNotRecognizedException;
@@ -18,7 +19,7 @@ import javax.xml.parsers.SAXParserFactory;
  */
 public class XMLFilterReader extends XMLFilterImpl {
 
-    private SAXParser parser;
+    private final SAXParser parser;
 
     public XMLFilterReader() {
         try {
@@ -30,6 +31,9 @@ public class XMLFilterReader extends XMLFilterImpl {
             parserFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
             parserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-dtd-grammar", false);
             parserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            parserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            parserFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            parserFactory.setXIncludeAware(false);
             parser = parserFactory.newSAXParser();
         } catch (ParserConfigurationException | SAXException e) {
             throw new IllegalArgumentException(e);

gradle.properties

@@ -1,5 +1,5 @@
 group = org.xbib
 name = content
-version = 5.0.0
+version = 5.0.1
 
 org.gradle.warning.mode = ALL