COMMONSXML-8: Base TransformerFactory and XPathFactory hardening on feature support - #17
Merged
garydgregory merged 3 commits intoJul 6, 2026
Conversation
Replace the class-name dispatch(TransformerFactory) switch with a capability-driven TransformerHardener, mirroring the DOM and SAX hardeners. It probes what the factory supports rather than branching per vendor, keeping a single documented class-name exception for Saxon, whose hardening (a Configuration that closes every resource-resolution channel plus the extension-function surface) is reachable only through a vendor API. Stock JDK XSLTC and Apache Xalan now share one recipe: FSP, best-effort limits and ACCESS_EXTERNAL_* (defense-in-depth where honoured), a deny-all URIResolver as the required block for xsl:import/xsl:include and document(), and a HardeningTransformerFactory wrapper. XSLTC previously relied on ACCESS_EXTERNAL_STYLESHEET as its required block and Xalan on the resolver; both now use the resolver, so ACCESS_EXTERNAL_* drops to best-effort. Both block paths surface as TransformerException, already accepted by the tests. Supporting changes: JaxpSetters gains setOptionalAttribute(TransformerFactory) and loses the now-unused strict setAttribute overload; Limits.applyToJdkTransformer becomes best-effort tryApply(TransformerFactory); StockJdkProvider and XalanProvider drop their configure(TransformerFactory) recipes (SaxonProvider is unchanged, still shared with XPath). Assisted-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the class-name dispatch(XPathFactory) switch with a capability-driven XPathHardener, mirroring TransformerHardener. The XPath object model splits the same way as TrAX: the stock JDK and Apache Xalan ship an XPath 1.0 engine with no URI-fetching functions, while Saxon adds the XPath 3.1 fn:doc, fn:collection and fn:unparsed-text functions. So it keeps one documented class-name exception for Saxon (net.sf.saxon plus the com.saxonica.config Professional/Enterprise editions, which subclass the open-source XPathFactoryImpl), handed to SaxonProvider for a locked-down Configuration; every other engine gets FSP (required) and best-effort FODP (stock JDK pins its bundled parser, Xalan rejects it). The two capability-driven hardeners are named after the product rather than the factory, matching DocumentBuilderHardener and SAXParserHardener. Supporting changes: JaxpSetters gains setOptionalFeature(XPathFactory); StockJdkProvider and XalanProvider are removed, since configure(XPathFactory) was their last remaining recipe (SaxonProvider is unchanged, shared with TrAX). Assisted-By: Claude Opus 4.8 <noreply@anthropic.com>
Member
|
Thank you @ppkarwasz , merged 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JIRA: https://issues.apache.org/jira/browse/COMMONSXML-8
Applies the capability-driven approach of COMMONSXML-1 to the last two paths, TrAX and XPath, with Saxon kept as the single documented class-name exception (a locked-down
Configuration, handled by the unchangedSaxonProvider).StockJdkProviderandXalanProviderare removed, and the two hardeners are named after the product (TransformerHardener,XPathHardener) to matchDocumentBuilderHardenerandSAXParserHardener.One change is worth noting on the TrAX path:
ACCESS_EXTERNAL_STYLESHEETis dropped in favor of the deny-allURIResolver, which already blocks the same channel (xsl:import/xsl:include,document()) uniformly across XSLTC and Xalan.ACCESS_EXTERNAL_DTDcould not be dropped. The JDK XSLTC copies this factory attribute onto the reader it uses to parse the stylesheet (Util.getInputSource), overwriting the value our hardened reader had set, so it is required there; Xalan rejects it and is covered by the hardened reader instead.