Disable Mybatis mapping validation by default for engine configurators

Author: jbarrez

modules/flowable-engine/src/main/java/org/flowable/engine/cfg/AbstractEngineConfigurator.java

@@ -44,6 +44,8 @@
  */
 public abstract class AbstractEngineConfigurator implements ProcessEngineConfigurator {
 
+    protected boolean enableMybatisXmlMappingValidation;
+    
     @Override
     public void beforeInit(ProcessEngineConfigurationImpl processEngineConfiguration) {
         registerCustomDeployers(processEngineConfiguration);
@@ -93,7 +95,7 @@ protected void registerCustomMybatisMappings(ProcessEngineConfigurationImpl proc
         if (cfgPath != null) {
             Set<String> resources = new HashSet<>();
             try (InputStream inputStream = this.getClass().getClassLoader().getResourceAsStream(cfgPath)) {
-                DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance();
+                DocumentBuilderFactory docBuilderFactory = createDocumentBuilderFactory();
                 DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder();
                 Document document = docBuilder.parse(inputStream);
                 NodeList nodeList = document.getElementsByTagName("mapper");
@@ -115,6 +117,18 @@ protected void registerCustomMybatisMappings(ProcessEngineConfigurationImpl proc
         }
     }
 
+    protected DocumentBuilderFactory createDocumentBuilderFactory() throws ParserConfigurationException {
+        DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance();
+        if (!enableMybatisXmlMappingValidation) {
+            docBuilderFactory.setValidating(false);
+            docBuilderFactory.setNamespaceAware(false);
+            docBuilderFactory.setExpandEntityReferences(false);
+            docBuilderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            docBuilderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-dtd-grammar", false);
+        }
+        return docBuilderFactory;
+    }
+    
     /**
      * Override when custom type aliases are needed.
      */
@@ -203,8 +217,16 @@ protected void initClock(ProcessEngineConfigurationImpl processEngineConfigurati
         targetEngineConfiguration.setClock(processEngineConfiguration.getClock());
     }
 
-    protected abstract List<Class<? extends Entity>> getEntityInsertionOrder() ;
+    protected abstract List<Class<? extends Entity>> getEntityInsertionOrder();
 
-    protected abstract List<Class<? extends Entity>> getEntityDeletionOrder() ;
+    protected abstract List<Class<? extends Entity>> getEntityDeletionOrder();
+
+    public boolean isEnableMybatisXmlMappingValidation() {
+        return enableMybatisXmlMappingValidation;
+    }
+
+    public void setEnableMybatisXmlMappingValidation(boolean enableMybatisXmlMappingValidation) {
+        this.enableMybatisXmlMappingValidation = enableMybatisXmlMappingValidation;
+    }
 
 }