State the threat-model scope by property contract and exclude transform outputs - #43
Merged
garydgregory merged 6 commits intoAug 25, 2026
Conversation
Two threat-model clarifications from triaging the 2026-08-15 scan findings: - What is in scope no longer enumerates recognized JAXP implementations: every implementation is in scope as long as it respects the contract of the features, attributes, and properties the hardening recipes use, and one that cannot accept a required setting makes the factory method throw instead of returning an unhardened factory. The out-of-scope bullet, the known non-findings bullet, and the foreign-implementation triage row are reworded to the same criterion; the previous implementation list survives as the set the recipes are exercised against. - A new out-of-scope bullet covers transform output destinations: the hardening governs what a parse or transform reads, not where a transform writes, so restricting the destinations of a stylesheet's output-producing instructions (xsl:result-document in particular) is the operator's responsibility when the stylesheet is untrusted. A matching known non-findings bullet gives such reports a landing place. Assisted-By: Claude Fable 5 <noreply@anthropic.com>
…ullet The property-contract criterion stands on its own; the surefire matrix already documents which implementations the recipes are exercised against. Assisted-By: Claude Fable 5 <noreply@anthropic.com>
…nd-transform-output
garydgregory
requested changes
Aug 25, 2026
garydgregory
left a comment
garydgregory
left a comment
Member
There was a problem hiding this comment.
Hi @ppkarwasz
I added 2 comments.
Thank you!
The newest platform API the recipes require is StAX, which entered JAXP at 1.4; the JAXP 1.5 ACCESS_EXTERNAL_* properties are deliberately unused, replaced by the resolver floors, so 1.5 is not the entry bar. The following sentence keeps conformance scoped to the specific settings each recipe uses. Assisted-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gm5jgtPUhD5YmvCDQaouh8
One sentence each in the threat model's scope section, the site index page, and the newTransformerFactory Javadoc, pointing at the Transform output destinations bullet for the full statement. Assisted-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gm5jgtPUhD5YmvCDQaouh8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two threat-model clarifications; documentation only, no code change.
Scope stated by property contract (f009)
What is in scope no longer enumerates "JAXP implementations it recognizes".
XmlFactoriesrecognizes properties, not implementations: every JAXP implementation is in scope as long as it respects the contract of the features, attributes, and properties the hardening recipes use, and an implementation that cannot accept a required setting makes the factory method throw instead of returning an unhardened factory.The out-of-scope bullet, the known-non-findings bullet, and the
OUT-OF-SCOPE: foreign implementationtriage row are reworded to the same criterion. This also settles the remark about the StAX path: the StAX floor is installed through the standardjavax.xml.stream.resolverhook, which the StAX specification requires every implementation to support, so it falls under the same contract with no per-API exception.Transform output destinations are out of scope (f010)
New out-of-scope bullet plus a matching known-non-findings bullet: the hardening governs what a parse or transform reads, not where a transform writes. A stylesheet's output-producing instructions (
xsl:result-documentin particular) write wherever the stylesheet directs, within the runtime's permissions; running a stylesheet grants its author that capability, so restricting destinations when the stylesheet is untrusted is the operator's responsibility (an output resolver of the implementation, filesystem permissions, or process sandboxing). Path-traversal or file-write reports through stylesheet output instructions now have an explicit disposition.Note
The in-scope bullet is also touched by #38 (Android best-effort wording) and the out-of-scope area by #41 (SAXTransformerFactory surface); whichever lands later reconciles small conflicts, keeping the contract framing together with those changes.
🤖 Generated with Claude Code