通过JAXB看XML外部实体注入(XML External Entity)

我们先使用JAXB提供的注解标记下java类和XML映射关系：

package jaxb;

import javax.xml.bind.annotation.XmlAccessType;
import javax.xml.bind.annotation.XmlAccessorType;
import javax.xml.bind.annotation.XmlElement;
import javax.xml.bind.annotation.XmlRootElement;

@XmlRootElement
@XmlAccessorType(XmlAccessType.FIELD)
public class Student {

	@XmlElement(name = "name")
	private String name;

	public String getName() {
		return name;
	}

	public void setName(String name) {
		this.name = name;
	}

	@Override
	public String toString() {
		return "Student [name=" + name + "]";
	}

}

下面这个类使用JAXB的API进行对象和xml直接的相互转换：

package jaxb;

import java.io.FileInputStream;
import java.io.StringReader;
import java.io.StringWriter;