Preventing Entity Expansion Attacks in JAXB

This post will cover how to protect yourself from the entity expansion attack when you are using JAXB.

Handling Duplicate @XmlRootElement Declarations

The following post was inspired by an answer I gave to a question on Stack Overflow (feel free to up vote).  The problem arose from a JAXBContext being created on classes derived from two schemas that both use the same root element.  The solution is to supply type of object to the unmarshal operation.

Using JAXB to Implement a Copy Operation

The following post was inspired by an answer I gave to a question on Stack Overflow (feel free to up vote).  I am not suggesting that JAXB should be used to implement copy methods, instead I'm using a copy operation to demonstrate that JAXB can treat an object model as XML input.  

JAXB and Choosing the List Implementation

For elements with max occurs greater than one, JAXB will generate a java.util.List property and the underlying implementation will be java.util.ArrayList.  You can control which list implementation is used through internal and external schema annotations.  You can also use your own domain objects which gives you full control of your object model.  This post will discuss these different options.

JAXB and Date/Time Properties

In this post I will describe how JAXB handles date/time information.  This post will also cover how the @XmlSchemaType annotation can be used to customize the XML representation.

Represent String Values as Element Names with JAXB ("foo" as <foo/>)

In this example we will map a String value to an element name.  Instead of <foo>bar</foo> we want <bar/>.  We will accomplish this by using @XmlAdapter and @XmlElementRef.

JAXB and Marshal/Unmarshal Schema Validation

In a previous post I described how to validate an object model (mapped with JAXB annotations) against an XML schema using the javax.xml.validation APIs.  In this post I'll describe how to leverage those APIs during unmarshal and marshal operations.

Extending JAXB - Representing Metadata as XML

In JAXB (JSR-222) metadata is applied to Java classes via standard annotations. There are times when using annotatations is not practical, and an alternate mechanism is required.  In this post I'll demonstrate how EclipseLink JAXB (MOXy) can leverage XML to represent the JAXB metadata.

An XML metadata representation is useful when:

• You cannot modify the domain model (it may come from a 3rd party).
• You do not want to introduce compile dependencies on JAXB APIs (if you are using a version of Java prior to Java SE 6).
• You want to apply multiple JAXB mappings to a domain model (you are limited to one representation with annotations).
• Your object model already contains so many annotations from other technologies that adding more would make the class unreadable.

Case Insensitive Unmarshalling with JAXB

Recently I've been asked in a couple different forums how to handle case insensitive unmarshalling in JAXB.  In this post I'll discuss an approach using a StAX StreamReaderDelegate.

I am considering adding this as an official feature, and would be interested in your feed back.  I am using the following bug to track this issue:

• https://bugs.eclipse.org/331241

JAXB and Immutable Objects

I was recently sent a blog post:  JAXB and immutable objects, by Aniket Shaligram.  In this post the author addresses the issue by adding a default constructor and using field access, to avoid adding set methods.  This approach is perfectly valid, but leaves the class being more mutable than some people like (including the person who sent me the link).  In this post I'll discuss an alternative approach using XmlAdapter.