jdk.xml.maxXMLNameLimit Java System Property

Default Value

1000

Overview of jdk.xml.maxXMLNameLimit

The java system property jdk.xml.maxXMLNameLimit sets an upper limit on the number of attributes an XML element may have. The value must be a positive integer. If set to 0 it indicates to the Java API For XML Parsing that there is no limit on the XML name length.

Here's an example of an XML document with a single tag, with an attribute named attribute:

<?xml version="1.0" ?>
<tagName attribute="value" />

In our example above we have an XML tag named tagName, the length of this string is 7 and is below our jdk.xml.maxXMLNameLimit value of 1000, so it will not throw an exception. If we created a tag name that was longer than 1000 characters then we would get an exception like this:

The length of entity "entityName" is "1,001" that exceeds the "1,000" limit set by "default"

You might also see in the message that the limit set by "FEATURE_SECURE_PROCESSING". The error code is JAXP00010005 for this exception.

Security Tip

Be careful when setting jdk.xml.maxXMLNameLimit that you do not to set it too high. If you set jdk.xml.maxXMLNameLimit too high, it may result in resource exhaustion, or a denial of service.

Related System Properties

Here are some other XML java system properties:

• java.xml.config.file
• javax.xml.accessExternalDTD
• jdk.xml.elementAttributeLimit
• jdk.xml.enableExtensionFunctions
• jdk.xml.entityExpansionLimit

References

• Oracle JAXP Security Guide

Set Via jaxp.properties

The jdk.xml.maxXMLNameLimit can be specified in the jaxp.properties file, typically located in jvm's conf/jaxp.properties of your JVM. You can also create your own jaxp.properties file which can be set via the java.xml.config.file java system property.

Supported Since

Java has supported the jdk.xml.maxXMLNameLimit system property since version 7u91, 8u65.

Setting jdk.xml.maxXMLNameLimit on Startup

You can set the jdk.xml.maxXMLNameLimit java system property during startup of the java runtime using the -D command line argument:

java -Djdk.xml.maxXMLNameLimit=1000 MyAppMain

You may also be able to specify jdk.xml.maxXMLNameLimit via the JAVA_TOOL_OPTIONS environment variable:

JAVA_TOOL_OPTIONS=-Djdk.xml.maxXMLNameLimit=1000

Setting / Reading jdk.xml.maxXMLNameLimit at Runtime

You can set jdk.xml.maxXMLNameLimit at runtime with the following Java code:

System.setProperty("jdk.xml.maxXMLNameLimit", "1000");

WARNING: Depending on the property and JVM version using setProperty may or may not work if the JDK Java class that uses this variable has already been loaded. The value of the jdk.xml.maxXMLNameLimit system property may be cached within an internal private static variable of the implementing class.

To read the value of jdk.xml.maxXMLNameLimit at runtime, you can use this Java code:

String propertyValue = System.getProperty("jdk.xml.maxXMLNameLimit");
if (propertyValue != null) {
    System.out.println("jdk.xml.maxXMLNameLimit = " + propertyValue);
} else {
    System.out.println("jdk.xml.maxXMLNameLimit was null");
}