<b>SAX2 Attributes</b> method (don't invoke on parser);
968185
@Override
    public String getType(String uri, String local) {
        int index = getIndex(uri, local);

        if (index < 0) {
            return null;
        }
        return getType(index);
    }
1027729
private void handleAttlistDecl()
        throws XMLStreamException
    {
        /* This method will handle PEs that contain the whole element
         * name. Since it's illegal to have partials, we can then proceed
         * to just use normal parsing...
         */
        char c = skipObligatoryDtdWs();
        final PrefixedName elemName = readDTDQName(c);

        /* Ok, event needs to know its exact starting point (opening '<'
         * char), let's get that info now (note: data has been preserved
         * earlier)
         */
        Location loc = getStartLocation();

        // Ok, where's our element?
        HashMap<PrefixedName,DTDElement> m = getElementMap();
        DTDElement elem = m.get(elemName);

        if (elem == null) { // ok, need a placeholder
            // Let's add ATTLIST location as the temporary location too
            elem = DTDElement.createPlaceholder(mConfig, loc, elemName);
            m.put(elemName, elem);
        }

        // Ok, need to loop to get all attribute defs:
        int index = 0;

        while (true) {
            /* White space is optional, if we get the closing '>' char;
             * otherwise it's obligatory.
             */
            c = getNextExpanded();
            if (isSpaceChar(c)) {
                // Let's push it back in case it's LF, to be handled properly
                --mInputPtr;
                c = skipDtdWs(true);

                /* 26-Jan-2006, TSa: actually there are edge cases where
                 *   we may get the attribute name right away (esp.
                 *   with PEs...); so let's defer possible error for
                 *   later on. Should not allow missing spaces between
                 *   attribute declarations... ?
                 */
                /*
            } else if (c != '>') {
                throwDTDUnexpectedChar(c, "; excepted either '>' closing ATTLIST declaration, or a white space character separating individual attribute declarations");
                */
            }
            if (c == '>') {
                break;
            }
            handleAttrDecl(elem, c, index, loc);
            ++index;
        }
    }
368691
public static void secureSaxParser(SAXParserFactory factory) throws ParserConfigurationException, SAXNotRecognizedException, SAXNotSupportedException {
		String FEATURE = null;

		// This is the PRIMARY defense. If DTDs (doctypes) are disallowed, almost all XML entity attacks are prevented
		// Xerces 2 only - http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl
		FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
		factory.setFeature(FEATURE, true);

		// If you can't completely disable DTDs, then at least do the following:
		// Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities
		// Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities
		// JDK7+ - http://xml.org/sax/features/external-general-entities
		FEATURE = "http://xml.org/sax/features/external-general-entities";
		factory.setFeature(FEATURE, false);

		// Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities
		// Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities
		// JDK7+ - http://xml.org/sax/features/external-parameter-entities
		FEATURE = "http://xml.org/sax/features/external-parameter-entities";
		factory.setFeature(FEATURE, false);

		// Disable external DTDs as well
		FEATURE = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
		factory.setFeature(FEATURE, false);

		// and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"
		factory.setXIncludeAware(false);
//		factory.setExpandEntityReferences(false); // not supported by sax factory

		// And, per Timothy Morgan: "If for some reason support for inline DOCTYPEs are a requirement, then
		// ensure the entity settings are disabled (as shown above) and beware that SSRF attacks
		// (http://cwe.mitre.org/data/definitions/918.html) and denial
		// of service attacks (such as billion laughs or decompression bombs via "jar:") are a risk."
		// remaining parser logic


		factory.setValidating(false);

	}
88287
public static void main(String[] args) {
        try {
            javax.xml.parsers.SAXParserFactory fac = javax.xml.parsers.SAXParserFactory.newInstance();
            fac.setNamespaceAware(true);
            fac.setValidating(false);
            XMLReader parser = fac.newSAXParser().getXMLReader();
            parser.setContentHandler(new HtmlSerializer(System.out));
            parser.parse(args[0]);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
1201783
public static Boolean getBooleanAttribute(XmlPullParser parser, String name) {
        String valueString = parser.getAttributeValue("", name);
        if (valueString == null)
            return null;
        valueString = valueString.toLowerCase(Locale.US);
        return parseXmlBoolean(valueString);
    }
736533
private AttributeDescr stringListAttribute(AttributeSupportBuilder<?> as,
            String[] key) throws RecognitionException {
        AttributeDescrBuilder<?> attribute = null;
        try {
            StringBuilder builder = new StringBuilder();
            for (String k : key) {
                if ("-".equals(k)) {
                    match(input,
                            DRL6Lexer.MINUS,
                            k,
                            null,
                            DroolsEditorType.KEYWORD); // part of the keyword
                    if (state.failed)
                        return null;
                } else {
                    match(input,
                            DRL6Lexer.ID,
                            k,
                            null,
                            DroolsEditorType.KEYWORD);
                    if (state.failed)
                        return null;
                }
                builder.append(k);
            }
            if (state.backtracking == 0) {
                attribute = helper.start((DescrBuilder<?, ?>) as,
                        AttributeDescrBuilder.class,
                        builder.toString());
            }

            builder = new StringBuilder();
            builder.append("[ ");
            Token value = match(input,
                    DRL6Lexer.STRING,
                    null,
                    null,
                    DroolsEditorType.STRING_CONST);
            if (state.failed)
                return null;
            builder.append(value.getText());

            while (input.LA(1) == DRL6Lexer.COMMA) {
                match(input,
                        DRL6Lexer.COMMA,
                        null,
                        null,
                        DroolsEditorType.SYMBOL);
                if (state.failed)
                    return null;
                builder.append(", ");
                value = match(input,
                        DRL6Lexer.STRING,
                        null,
                        null,
                        DroolsEditorType.STRING_CONST);
                if (state.failed)
                    return null;
                builder.append(value.getText());
            }
            builder.append(" ]");
            if (state.backtracking == 0) {
                attribute.value(builder.toString());
                attribute.type(AttributeDescr.Type.LIST);
            }
        } finally {
            if (attribute != null) {
                helper.end(AttributeDescrBuilder.class,
                        attribute);
            }
        }
        return attribute != null ? attribute.getDescr() : null;
    }
793296
def method_missing(meth, *args)
      m = meth.id2name
      if m =~ /=$/
        @attributes[m.chop.to_sym] = (args.length < 2 ? args[0] : args)
      else
        @attributes[m.to_sym]
      end
    end
746291
public static String xmlAttribEncode(final String attrValue) {
    final StringBuffer buf = new StringBuffer(attrValue);
    int quotePos;

    for (quotePos = -1; (quotePos = buf.indexOf("\"", quotePos + 1)) >= 0;) {
      buf.deleteCharAt(quotePos);
      buf.insert(quotePos, "&quot;");
      quotePos += 5;
    }

    for (quotePos = -1; (quotePos = buf.indexOf("<", quotePos + 1)) >= 0;) {
      buf.deleteCharAt(quotePos);
      buf.insert(quotePos, "&lt;");
      quotePos += 3;
    }

    for (quotePos = -1; (quotePos = buf.indexOf(">", quotePos + 1)) >= 0;) {
      buf.deleteCharAt(quotePos);
      buf.insert(quotePos, "&gt;");
      quotePos += 3;
    }

    return buf.toString();
  }
1278915
private void parseEntSubAttributes(final Entity ent, final Node node) throws ResourceXMLParserException {
        final Element node1 = (Element) node;
        //load all sub elements called "attribute" as properties
        for (final Object attribute : node1.selectNodes(ATTRIBUTE_TAG)) {
            Element attr=(Element) attribute;
            if(null==attr.selectSingleNode("@" + ATTRIBUTE_NAME_ATTR)) {
                throw new ResourceXMLParserException(
                    ATTRIBUTE_TAG + " element has no '" + ATTRIBUTE_NAME_ATTR + "' attribute: "
                    + reportNodeErrorLocation(attr));
            }
            String attrname = attr.selectSingleNode("@" + ATTRIBUTE_NAME_ATTR).getStringValue();

            String attrvalue;
            //look for "value" attribute
            if(null!=attr.selectSingleNode("@"+ATTRIBUTE_VALUE_ATTR)) {
                attrvalue = attr.selectSingleNode("@" + ATTRIBUTE_VALUE_ATTR).getStringValue();
            }else if(null!= attr.getText()) {
                //look for text content
                attrvalue = attr.getText();
            }else {
                throw new ResourceXMLParserException(
                    ATTRIBUTE_TAG + " element has no '" + ATTRIBUTE_VALUE_ATTR + "' attribute or text content: "
                    + reportNodeErrorLocation(attr));
            }

            ent.properties.setProperty(attrname, attrvalue);
        }
    }
941782
private AttributeDescr booleanAttribute( AttributeSupportBuilder< ? > as,
                                             String[] key ) throws RecognitionException {
        AttributeDescrBuilder< ? > attribute = null;
        try {
            StringBuilder builder = new StringBuilder();
            for ( String k : key ) {
                if ( "-".equals( k ) ) {
                    match( input,
                           DRL5Lexer.MINUS,
                           k,
                           null,
                           DroolsEditorType.KEYWORD ); // part of the keyword
                    if ( state.failed ) return null;
                } else {
                    match( input,
                           DRL5Lexer.ID,
                           k,
                           null,
                           DroolsEditorType.KEYWORD );
                    if ( state.failed ) return null;
                }
                builder.append( k );
            }
            if ( state.backtracking == 0 ) {
                attribute = helper.start( (DescrBuilder< ? , ? >) as,
                                          AttributeDescrBuilder.class,
                                          builder.toString() );
            }

            String value = "true";
            if ( input.LA( 1 ) == DRL5Lexer.BOOL ) {
                Token bool = match( input,
                                    DRL5Lexer.BOOL,
                                    null,
                                    null,
                                    DroolsEditorType.KEYWORD );
                if ( state.failed ) return null;
                value = bool.getText();
            }
            if ( state.backtracking == 0 ) {
                attribute.value( value );
                attribute.type( AttributeDescr.Type.BOOLEAN );
            }
        } finally {
            if ( attribute != null ) {
                helper.end( AttributeDescrBuilder.class,
                            attribute );
            }
        }
        return attribute != null ? attribute.getDescr() : null;
    }
497959
public void printXMLElement(String name, Map<String, String> attributes)
    {
        Element element = new DefaultElement(name);

        if (attributes != null && !attributes.isEmpty()) {
            for (Map.Entry<String, String> entry : attributes.entrySet()) {
                element.addAttribute(entry.getKey(), entry.getValue());
            }
        }

        try {
            this.xmlWriter.write(element);
        } catch (IOException e) {
            // TODO: add error log here
        }
    }
1334891
@Override
  protected void visitHtmlAttributeNode(HtmlAttributeNode node) {
    // Skip attributes that do not have a value.
    if (!node.hasValue()) {
      return;
    }
    SourceLocation insertionLocation = node.getSourceLocation();
    for (FunctionNode function : SoyTreeUtils.getAllNodesOfType(node, FunctionNode.class)) {
      if (!(function.getSoyFunction() instanceof LoggingFunction)) {
        continue;
      }
      FunctionNode funcNode =
          new FunctionNode(
              Identifier.create(VeLogJsSrcLoggingFunction.NAME, insertionLocation),
              VeLogJsSrcLoggingFunction.INSTANCE,
              insertionLocation);
      funcNode.addChild(
          new StringNode(function.getFunctionName(), QuoteStyle.SINGLE, insertionLocation));
      funcNode.addChild(new ListLiteralNode(function.getChildren(), insertionLocation));
      StandaloneNode attributeName = node.getChild(0);
      if (attributeName instanceof RawTextNode) {
        // If attribute name is a plain text, directly pass it as a function argument.
        funcNode.addChild(
            new StringNode(
                ((RawTextNode) attributeName).getRawText(), QuoteStyle.SINGLE, insertionLocation));
      } else {
        // Otherwise wrap the print node or call node into a let block, and use the let variable
        // as a function argument.
        String varName = "$soy_logging_function_attribute_" + node.getId();
        LetContentNode letNode =
            LetContentNode.forVariable(
                nodeIdGen.genId(),
                attributeName.getSourceLocation(),
                varName,
                attributeName.getSourceLocation(),
                null);
        // Adds a let var which references to the original attribute name, and move the name to
        // the let block.
        node.replaceChild(
            attributeName,
            new PrintNode(
                nodeIdGen.genId(),
                insertionLocation,
                /* isImplicit= */ true,
                /* expr= */ new VarRefNode(
                    letNode.getVar().name(), insertionLocation, letNode.getVar()),
                /* attributes= */ ImmutableList.of(),
                ErrorReporter.exploding()));
        letNode.addChild(attributeName);
        node.getParent().addChild(node.getParent().getChildIndex(node), letNode);
        funcNode.addChild(
            new VarRefNode(letNode.getVar().name(), insertionLocation, letNode.getVar()));
      }
      PrintNode loggingFunctionAttribute =
          new PrintNode(
              nodeIdGen.genId(),
              insertionLocation,
              /* isImplicit= */ true,
              /* expr= */ funcNode,
              /* attributes= */ ImmutableList.of(),
              ErrorReporter.exploding());
      // Append the logging function attribute to its parent
      int appendIndex = node.getParent().getChildIndex(node) + 1;
      node.getParent().addChild(appendIndex, loggingFunctionAttribute);
      // Replace the original attribute value to the placeholder.
      HtmlAttributeValueNode placeHolder =
          new HtmlAttributeValueNode(nodeIdGen.genId(), insertionLocation, Quotes.DOUBLE);
      placeHolder.addChild(
          new RawTextNode(
              nodeIdGen.genId(),
              ((LoggingFunction) function.getSoyFunction()).getPlaceholder(),
              insertionLocation));
      node.replaceChild(node.getChild(1), placeHolder);
      // We can break here since VeLogValidationPass guarantees that there is exactly one
      // logging function in a html attribute value.
      break;
    }
    visitChildrenAllowingConcurrentModification(node);
  }
252816
public static AttributesBuilder attributes(String[] arguments) {
        AttributesBuilder attributesBuilder = new AttributesBuilder();
        attributesBuilder.arguments(arguments);
        return attributesBuilder;
    }
882787
public String attributes()
    {
        if (attributes==null && attributeMap==null)
            return noAttributes;

        StringBuffer buf = new StringBuffer(128);
        synchronized(buf)
        {
            if (attributeMap!=null)
            {
                Enumeration e = attributeMap.keys();
                while (e.hasMoreElements())
                {
                    buf.append(' ');
                    String a = (String)e.nextElement();
                    buf.append(a);
                    buf.append('=');
                    buf.append(attributeMap.get(a).toString());
                }
            }
            
            if(attributes!=null && attributes.length()>0)
            {
                if (!attributes.startsWith(" "))
                    buf.append(' ');
                buf.append(attributes);
            }
        }

        return buf.toString();
    }
631128
public XML deleteAttributes(Class<?> aClass,String[] attributes){
		checksAttributesExistence(aClass,attributes);
		
		if(isEmpty(findXmlClass(aClass).attributes) || findXmlClass(aClass).attributes.size()<=1)
			Error.xmlWrongMethod(aClass);
		
		for (String attributeName : attributes) {
			XmlAttribute attribute = null;
			for (XmlAttribute xmlAttribute : findXmlClass(aClass).attributes)
				if(xmlAttribute.name.equals(attributeName))
					attribute = xmlAttribute;
			
			if(attribute == null) Error.xmlAttributeInexistent(this.xmlPath,attributeName,aClass);
				
			findXmlClass(aClass).attributes.remove(attribute);
		}
		return this;
	}
374134
private void extractAttributes(String attributes)
	{
		String s = attributes.trim();
		if (s.length() > 0 && s.charAt(s.length() - 1) == '/')
			elem.setEmptyElementTag(true);

		while (s.length() != 0) {
			final int equal = s.indexOf('=');
			if (equal == -1 || equal == s.length() - 1)
				break;
			// cut off attribute name
			final String att = s.substring(0, equal).trim();
			s = s.substring(equal + 1).trim();
			if (s.length() == 0)
				break;
			final boolean quote = s.charAt(0) == '\'' || s.charAt(0) == '\"';
			if (att.length() > 0 && quote) {
				String value = s.substring(1);
				final int end = value.indexOf(s.charAt(0));
				if (end >= 0)
					value = value.substring(0, end);
				elem
					.addAttribute(new Attribute(att, References.replace(value, false)));
			}
			final int i = s.indexOf(quote ? s.charAt(0) : ' ', 1);
			s = i == -1 ? "" : s.substring(i + 1);
		}
	}
725838
static void generateAttribute(XsdAttribute attribute, String apiName){
        String camelAttributeName = getAttributeName(attribute);
        XsdList list = getAttributeList(attribute);
        String javaType = list != null ? JAVA_LIST_DESC : getFullJavaType(attribute);

        boolean hasEnum = attributeHasEnum(attribute);

        if (hasEnum){
            getAttributeRestrictions(attribute)
                    .stream()
                    .filter(restriction -> restriction.getEnumeration() != null)
                    .forEach(restriction -> createEnum(attribute, restriction.getEnumeration(), apiName));
        }

        if (attributeHasRestrictions(attribute)){
            ClassWriter attributeWriter = generateClass(camelAttributeName, JAVA_OBJECT, null, null, ACC_PUBLIC + ACC_FINAL + ACC_SUPER, apiName);

            MethodVisitor mVisitor = attributeWriter.visitMethod(ACC_PRIVATE, CONSTRUCTOR, "()V", null, null);
            mVisitor.visitCode();
            mVisitor.visitVarInsn(ALOAD, 0);
            mVisitor.visitMethodInsn(INVOKESPECIAL, JAVA_OBJECT, CONSTRUCTOR, "()V", false);
            mVisitor.visitInsn(RETURN);
            mVisitor.visitMaxs(1, 1);
            mVisitor.visitEnd();

            if (hasEnum){
                String enumTypeDesc = getFullClassTypeNameDesc(getEnumName(attribute), apiName);

                mVisitor = attributeWriter.visitMethod(ACC_PUBLIC + ACC_STATIC, "validateRestrictions", "(" + enumTypeDesc + ")V", null, null);
            } else {
                String signature = list != null ? "(L" + JAVA_LIST + "<" + getFullJavaType(list.getItemType()) + ">;)V" : null;

                mVisitor = attributeWriter.visitMethod(ACC_PUBLIC + ACC_STATIC, "validateRestrictions", "(" + javaType + ")V", signature, null);
            }

            mVisitor.visitCode();

            if (hasEnum){
                String enumName = getEnumName(attribute);
                String enumType = getFullClassTypeName(enumName, apiName);

                mVisitor.visitVarInsn(ALOAD, 0);
                mVisitor.visitMethodInsn(INVOKEVIRTUAL, enumType, "getValue", "()" + getEnumContainingType(attribute), false);
                mVisitor.visitVarInsn(ASTORE, 1);
            }

            loadRestrictionsToAttribute(attribute, mVisitor, javaType, hasEnum);

            writeClassToFile(camelAttributeName, attributeWriter, apiName);
        }
    }