#526 Incorporating review comments

* renaming accessors
* changing the default to disallow external resources
* introduced system-property for backwards compatibility
* honor system-property (if present) and SVGReadParams.isAllowExternalResources hasn't been called
  (as against ignoring system-property and reverting to 'block-by-default' if SVGReadParams.isAllowExternalResources invoked)
* added + updated test cases

imageio/imageio-batik/src/main/java/com/twelvemonkeys/imageio/plugins/svg/SVGImageReader.java

@@ -79,8 +79,12 @@ import java.util.Map;
  * @see <A href="http://www.mail-archive.com/batik-dev@xml.apache.org/msg00992.html">batik-dev</A>
  */
 public class SVGImageReader extends ImageReaderBase {
+
+    static String ALLOW_EXTERNAL_RESOURCES_SYSTEM_PROP = "com.twelvemonkeys.imageio.plugins.svg.allowexternalresources";
+
     private Rasterizer rasterizer;
-    private boolean allowExternalResources;
+    private boolean allowExternalResources =
+            "true".equalsIgnoreCase(System.getProperty(ALLOW_EXTERNAL_RESOURCES_SYSTEM_PROP));
 
     /**
      * Creates an {@code SVGImageReader}.
@@ -89,7 +93,6 @@ public class SVGImageReader extends ImageReaderBase {
      */
     public SVGImageReader(final ImageReaderSpi pProvider) {
         super(pProvider);
-        allowExternalResources = true;
     }
 
     protected void resetMembers() {
@@ -119,7 +122,7 @@ public class SVGImageReader extends ImageReaderBase {
             SVGReadParam svgParam = (SVGReadParam) pParam;
 
             // set the external-resource-resolution preference
-            allowExternalResources = svgParam.shouldAllowExternalResources();
+            allowExternalResources = svgParam.isAllowExternalResources();
 
             // Get the base URI
             // This must be done before converting the params to hints

imageio/imageio-batik/src/main/java/com/twelvemonkeys/imageio/plugins/svg/SVGReadParam.java

@@ -41,11 +41,11 @@ import java.awt.*;
 public class SVGReadParam extends ImageReadParam {
     private Paint background;
     private String baseURI;
-    private boolean allowExternalResources;
+    private boolean allowExternalResources = false;
+    private boolean isAllowExternalResourcesSetExplicitly = false;
 
     public SVGReadParam() {
         super();
-        allowExternalResources = true;
     }
 
     public Paint getBackgroundColor() {
@@ -64,12 +64,18 @@ public class SVGReadParam extends ImageReadParam {
         baseURI = pBaseURI;
     }
 
-    public void allowExternalResources(boolean bAllow) {
+    public void setAllowExternalResources(boolean allow) {
-        allowExternalResources = bAllow;
+        allowExternalResources = allow;
+        isAllowExternalResourcesSetExplicitly = true;
     }
 
-    public boolean shouldAllowExternalResources() {
+    public boolean isAllowExternalResources() {
+        if (isAllowExternalResourcesSetExplicitly) {
             return allowExternalResources;
+        } else {
+            // prefer the explicitly set value if invoked, read the system prop as a fallback if it wasn't
+            return "true".equals(System.getProperty(SVGImageReader.ALLOW_EXTERNAL_RESOURCES_SYSTEM_PROP));
+        }
     }
 
     @Override

imageio/imageio-batik/src/test/java/com/twelvemonkeys/imageio/plugins/svg/SVGImageReaderTest.java

@@ -228,6 +228,7 @@ public class SVGImageReaderTest extends ImageReaderAbstractTest<SVGImageReader>
             reader.addIIOReadWarningListener(listener);
 
             SVGReadParam param = reader.getDefaultReadParam();
+            param.setAllowExternalResources(true);
             param.setBaseURI(resource.toURI().toASCIIString());
             BufferedImage image = reader.read(0, param);
 
@@ -244,12 +245,16 @@ public class SVGImageReaderTest extends ImageReaderAbstractTest<SVGImageReader>
     }
 
     @Test
-    public void testEmbeddedBeforeBaseURI() throws URISyntaxException, IOException {
+    public void testEmbeddedBeforeBaseURI_withSystemProperty() throws URISyntaxException, IOException {
         // Asking for metadata, width, height etc, before attempting to read using a param,
         // will cause the document to be parsed without a base URI.
         // This will work, but may not use the CSS...
+        // since the param is not available before the read operation is invoked,
+        // this test-case MUST use the system-property for backwards compatibility
         URL resource = getClassLoaderResource("/svg/barChart.svg");
 
+        try {
+            System.setProperty("com.twelvemonkeys.imageio.plugins.svg.allowexternalresources", "true");
             SVGImageReader reader = createReader();
 
             TestData data = new TestData(resource, (Dimension) null);
@@ -280,24 +285,28 @@ public class SVGImageReaderTest extends ImageReaderAbstractTest<SVGImageReader>
             finally {
                 reader.dispose();
             }
+        } finally {
+            System.clearProperty("com.twelvemonkeys.imageio.plugins.svg.allowexternalresources");
+        }
     }
 
     @Test
-    public void testEmbeddedNoBaseURI() throws IOException {
+    public void testEmbeddedNoBaseURI_withSystemProperty() throws IOException {
         // With no base URI, we will throw an exception, about the missing embedded resource
         URL resource = getClassLoaderResource("/svg/barChart.svg");
 
+        try {
+            System.setProperty("com.twelvemonkeys.imageio.plugins.svg.allowexternalresources", "true");
+
             SVGImageReader reader = createReader();
 
             TestData data = new TestData(resource, (Dimension) null);
             try (ImageInputStream stream = data.getInputStream()) {
                 reader.setInput(stream);
 
-            BufferedImage image = reader.read(0);
+                reader.read(0);
 
-            assertNotNull(image);
+                assertTrue("reader.read should've thrown an exception, but didn't", false);
-            assertEquals(450, image.getWidth());
-            assertEquals(500, image.getHeight());
             }
             catch (IIOException allowed) {
                 assertTrue(allowed.getMessage().contains("batikLogo.svg")); // The embedded resource we don't find
@@ -305,10 +314,13 @@ public class SVGImageReaderTest extends ImageReaderAbstractTest<SVGImageReader>
             finally {
                 reader.dispose();
             }
+        } finally {
+            System.clearProperty("com.twelvemonkeys.imageio.plugins.svg.allowexternalresources");
+        }
     }
 
     @Test(expected = SecurityException.class)
-    public void testDisallowedExternalResources() throws URISyntaxException, IOException {
+    public void testDefaultDisallowedExternalResources() throws URISyntaxException, IOException {
         URL resource = getClassLoaderResource("/svg/barChart.svg");
 
         SVGImageReader reader = createReader();
@@ -319,7 +331,6 @@ public class SVGImageReaderTest extends ImageReaderAbstractTest<SVGImageReader>
 
             SVGReadParam param = reader.getDefaultReadParam();
             param.setBaseURI(resource.toURI().toASCIIString());
-            param.allowExternalResources(false);
             // `reader.read` for `/svg/barChart.svg` should raise
             // a SecurityException when External Resources are blocked
             reader.read(0, param);
@@ -328,4 +339,32 @@ public class SVGImageReaderTest extends ImageReaderAbstractTest<SVGImageReader>
             reader.dispose();
         }
     }
+
+    @Test(expected = SecurityException.class)
+    public void testDisallowedExternalResources_withSystemProperty() throws URISyntaxException, IOException {
+        URL resource = getClassLoaderResource("/svg/barChart.svg");
+        try {
+            System.setProperty("com.twelvemonkeys.imageio.plugins.svg.allowexternalresources", "true");
+            SVGImageReader reader = createReader();
+
+            TestData data = new TestData(resource, (Dimension) null);
+            try (ImageInputStream stream = data.getInputStream()) {
+                reader.setInput(stream);
+
+                SVGReadParam param = reader.getDefaultReadParam();
+                param.setBaseURI(resource.toURI().toASCIIString());
+                param.setAllowExternalResources(false);
+                // even when the system-property is set to true,
+                // `reader.read` for `/svg/barChart.svg` should raise
+                // a SecurityException when External Resources are blocked
+                // because the API invocation gets preference
+                reader.read(0, param);
+            }
+            finally {
+                reader.dispose();
+            }
+        } finally {
+            System.clearProperty("com.twelvemonkeys.imageio.plugins.svg.allowexternalresources");
+        }
+    }
 }