docs: document the supported-runtime floor (OpenJDK 8+, Android 33+) - #38
Open
ppkarwasz wants to merge 1 commit into
Open
docs: document the supported-runtime floor (OpenJDK 8+, Android 33+)#38ppkarwasz wants to merge 1 commit into
ppkarwasz wants to merge 1 commit into
Conversation
State that the hardening guarantees are defined on OpenJDK 8 or later, or Android API level 33 or later. The bounded entity-expansion guarantee (Billion Laughs) relies on the platform's secure-processing limit, which on Android is libexpat's built-in check; that check first ships in API 33, so on Android below 33 the guarantee does not hold. Reports demonstrated only on an unsupported Android release are out of scope. Qualifies the previously unconditional guarantee in the XmlFactories class Javadoc, the threat model (Assumptions about the environment, What is out of scope, Known non-findings, Conditions that would change this model), and the index page. No behavior change. Assisted-By: Claude Fable 5 <noreply@anthropic.com>
garydgregory
requested changes
Aug 18, 2026
Member
There was a problem hiding this comment.
@ppkarwasz
I don't think we should guarantee anything on Android. We can document the behavior, but certainly not guarantee it. I see Android as "nice to have" only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the supported-runtime floor so the hardening guarantees match what the platform can actually enforce, addressing the Android-below-33 gap where the bounded entity-expansion (Billion Laughs) guarantee does not hold.
The guarantee relies on the platform's secure-processing limit. On Android that limit is libexpat's built-in billion-laughs check, which first ships in API level 33 (AOSP libexpat >= 2.4). On Android below 33 there is no such check, so the previously unconditional bounded-expansion guarantee cannot hold. A JDK older than 8 needs no such caveat: the classes are compiled for Java 8 and cannot be loaded on an earlier one.
Changes
XmlFactoriesclass Javadoc: the bounded-expansion guarantee is now "bounded by the platform's secure-processing limit", with a note that the guarantees are defined on OpenJDK 8+ / Android API 33+ and do not hold on Android below 33.threat_model.md: new Supported runtimes paragraph under Assumptions about the environment; the existing Billion Laughs claim is scoped to the supported runtimes; new What is out of scope and Known non-findings bullets for an unsupported Android release; Conditions that would change this model now lists a change to the supported runtimes.index.md: new Supported runtimes subsection under Usage.Notes
android-testsminSdkstays 19 (the library still runs below 33, it is just not security-supported there).src/site/markdownuses semantic line breaks per project convention.🤖 Generated with Claude Code