commons-secure-xml/RELEASE-NOTES.txt at main · apache/commons-secure-xml · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements.  See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License.  You may obtain a copy of the License at

https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Apache Commons Secure XML 1.0.0 Release Notes
---------------------------------------------

The Apache Commons Secure XML team is pleased to announce the release of Apache Commons Secure XML 1.0.0.

Apache Commons Secure XML provides secure-by-default JAXP factory creation, abstracting over
implementation-specific XXE securing differences between the stock JDK and external JAXP implementations
(Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).

First release, requires Java 8 or above.


New features
------------

*                  This is the first release of Apache Commons Secure XML. Thanks to Piotr P. Karwasz, Gary Gregory.
*                  Add secure-by-default JAXP factory creation via org.apache.commons.xml.secure, donated from the copernik-xml-factory project (https://github.com/copernik-eu/copernik-xml-factory) and covering the stock JDK, Android, Apache Xalan, Apache Xerces, Woodstox, and Saxon-HE. Thanks to Piotr P. Karwasz, Gary Gregory.
* COMMONSXML-9:    Install a non-removable resolver floor on every resolver channel (EntityResolver, LSResourceResolver, URIResolver, and XMLResolver), routing caller-supplied resolvers through it as allow-lists. Thanks to Piotr P. Karwasz, Gary Gregory.
*                  Secure the SAXTransformerFactory extension surface (TransformerHandler, TemplatesHandler, and XMLFilter) and TransformerFactory.getAssociatedStylesheet. Thanks to Piotr P. Karwasz, Gary Gregory.
*                  Document the threat model on the project site, including the denied-fetch contract and the supported runtime floor (OpenJDK 8 and Android API 33 or later). Thanks to Piotr P. Karwasz, Jarek Potiuk, Gary Gregory.
* COMMONSXML-11:   Add GitHub CI builds for Java 26 and 27-EA. Thanks to Gary Gregory, Piotr P. Karwasz.
*                  Mirror on each factory class every JAXP static factory method, including the Java 9 newDefaultInstance and Java 13 newNSInstance families, all usable on Java 8. Thanks to Piotr P. Karwasz, Gary Gregory.

Fixed Bugs
----------

* COMMONSXML-10:   Block XInclude (xi:include) href resolution by default, since the JAXP external-access properties do not govern it. Thanks to Ta Duc Thien, Piotr P. Karwasz, Gary Gregory.
*                  Honor jdk.xml.overrideDefaultParser on TrAX, XPath and schema factories that recognize it. Thanks to Piotr P. Karwasz, Gary Gregory.
*                  Restore the secure configuration when a factory or parser is reset() instead of reverting to the implementation defaults. Thanks to Piotr P. Karwasz, Gary Gregory.
*                  Parse a Source opted in by a caller-supplied URIResolver using a secure parser. Thanks to Piotr P. Karwasz, Gary Gregory.
*                  Secure the document parse behind the InputSource-taking XPath evaluation entry points. Thanks to Piotr P. Karwasz, Gary Gregory.
*                  Fall back to the standard factory lookup in the DOM, SAX and schema newDefaultInstance methods on Android. Thanks to Piotr P. Karwasz, Gary Gregory.

Changes
-------

* COMMONSXML-1,COMMONSXML-5,COMMONSXML-6,COMMONSXML-7,COMMONSXML-8: Recognize XML implementations by the JAXP features and properties they support instead of by their implementation class name, extending the securing to any compliant implementation. Thanks to Piotr P. Karwasz, Gary Gregory.
* COMMONSXML-4:    Define a consistent contract for denied external fetches: unresolved external references resolve to empty content on every implementation, unless the org.apache.commons.xml.secure.throwOnUnresolved system property requests rejection. Thanks to Piotr P. Karwasz, Gary Gregory.
* COMMONSXML-3:    Reduce the shaded footprint by splitting the secure classes and resolver floors into independent entry points. Thanks to Piotr P. Karwasz, Gary Gregory.
*                  Allow the JAXP 1.5 accessExternal properties to be modified on secured factories. Thanks to Piotr P. Karwasz, Gary Gregory.

Removed
-------

* COMMONSXML-2:    Remove the Limits class that applied uniform processing limits across implementations. Thanks to Piotr P. Karwasz, Gary Gregory.

Historical list of changes: https://commons.apache.org/proper/commons-secure-xml//changes.html

For complete information on Apache Commons Secure XML, including instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons Secure XML website:

https://commons.apache.org/proper/commons-secure-xml/

Download page: https://commons.apache.org/proper/commons-secure-xml//download_text.cgi

Have fun!
-Apache Commons Team

-----------------------------------------------------------------------------