Skip to content

[COMMONSXML-9] Make the resolver floor non-removable across JAXP implementations #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
garydgregory merged 21 commits into from
Jul 8, 2026
Merged

[COMMONSXML-9] Make the resolver floor non-removable across JAXP implementations #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
8459034
Make the deny-all entity resolver a non-overridable floor (Xerces and…
ppkarwasz Jul 6, 2026
4caa700
Extract HardeningDocumentBuilderFactory and reuse the resolver floor
ppkarwasz Jul 6, 2026
04ea092
Add regression test for external schema-location properties
ppkarwasz Jul 6, 2026
bd32bbe
Make the schema resource resolver a non-overridable floor
ppkarwasz Jul 6, 2026
c4566ae
Make the transformer URI resolver a non-overridable floor
ppkarwasz Jul 6, 2026
b3d8bf8
Make the StAX XML resolver a non-overridable floor
ppkarwasz Jul 6, 2026
4a17b61
Resolve relative systemId before delegating to a plain EntityResolver
ppkarwasz Jul 7, 2026
619fba4
Clarify the resolver-floor Javadoc
ppkarwasz Jul 7, 2026
66c18ff
Document the resolver floor in the threat model
ppkarwasz Jul 7, 2026
0db292f
Set the system id on the XInclude test resolver's InputSource
ppkarwasz Jul 7, 2026
9b36075
Use US spelling consistently in comments and docs
ppkarwasz Jul 7, 2026
4814fc8
Merge remote-tracking branch 'apache/main' into feature/resolver-floor
ppkarwasz Jul 7, 2026
ba0272e
Guard resolver-property casts in HardeningXMLInputFactory
ppkarwasz Jul 7, 2026
16fe01b
fix: sort AttackTestSupport
ppkarwasz Jul 7, 2026
a6b7121
fix: simplify HardeningXMLInputFactory
ppkarwasz Jul 7, 2026
bec0fb2
Merge Delegating wrappers into their Hardening subclasses
ppkarwasz Jul 7, 2026
84f8a36
Add trailing newline to files missing EOL at EOF
ppkarwasz Jul 7, 2026
863262e
Fold DelegatingXMLReader into HardeningXMLReader
ppkarwasz Jul 7, 2026
30fd1f4
Revert EOL
ppkarwasz Jul 8, 2026
3449718
Revert incidental spelling and comma changes
ppkarwasz Jul 8, 2026
b309ee3
Revert incidental spelling and wording changes
ppkarwasz Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
88 changes: 0 additions & 88 deletions src/main/java/org/apache/commons/xml/DelegatingSAXParser.java
View file
Open in desktop

This file was deleted.

94 changes: 0 additions & 94 deletions src/main/java/org/apache/commons/xml/DelegatingSAXParserFactory.java
View file
Open in desktop

This file was deleted.

95 changes: 0 additions & 95 deletions src/main/java/org/apache/commons/xml/DelegatingSchemaFactory.java
View file
Open in desktop

This file was deleted.

46 changes: 0 additions & 46 deletions src/main/java/org/apache/commons/xml/DelegatingTemplates.java
View file
Open in desktop

This file was deleted.

Loading
Loading