This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 4d960b98d2260b9fb98cdc9ad5142741b4bbf853 Merge: d246386 b309ee3 Author: Gary Gregory <[email protected]> AuthorDate: Wed Jul 8 16:05:19 2026 -0400 Merge pull request #18 from ppkarwasz/feature/resolver-floor [COMMONSXML-9] Make the resolver floor non-removable across JAXP implementations .../apache/commons/xml/DelegatingSAXParser.java | 88 ----- .../commons/xml/DelegatingSAXParserFactory.java | 94 ------ .../commons/xml/DelegatingSchemaFactory.java | 95 ------ .../apache/commons/xml/DelegatingTemplates.java | 46 --- .../apache/commons/xml/DelegatingTransformer.java | 104 ------ .../commons/xml/DelegatingTransformerFactory.java | 133 -------- .../commons/xml/DocumentBuilderHardener.java | 28 +- .../commons/xml/HardeningDocumentBuilder.java | 103 ++++++ ...y.java => HardeningDocumentBuilderFactory.java} | 24 +- .../org/apache/commons/xml/HardeningSAXParser.java | 48 ++- .../commons/xml/HardeningSAXParserFactory.java | 63 +++- .../org/apache/commons/xml/HardeningSchema.java | 10 +- .../apache/commons/xml/HardeningSchemaFactory.java | 77 ++++- .../org/apache/commons/xml/HardeningTemplates.java | 20 +- .../apache/commons/xml/HardeningTransformer.java | 86 ++++- .../commons/xml/HardeningTransformerFactory.java | 95 +++++- .../org/apache/commons/xml/HardeningValidator.java | 15 +- .../commons/xml/HardeningValidatorHandler.java | 160 +++++++++ .../commons/xml/HardeningXMLInputFactory.java | 214 ++++++++++++ ...atingXMLReader.java => HardeningXMLReader.java} | 45 ++- .../java/org/apache/commons/xml/Resolvers.java | 291 ++++++++++++---- .../org/apache/commons/xml/SAXParserHardener.java | 83 ++--- .../java/org/apache/commons/xml/StaxHardener.java | 72 ++-- .../apache/commons/xml/TransformerHardener.java | 17 +- src/site/markdown/threat_model.md | 40 ++- .../org/apache/commons/xml/AttackTestSupport.java | 48 ++- .../commons/xml/EntityResolverFloorTest.java | 376 +++++++++++++++++++++ .../commons/xml/SchemaLocationPropertyTest.java | 187 ++++++++++ src/test/resources/leaked/no-namespace.xsd | 5 + src/test/resources/leaked/with-xinclude.xml | 5 + 30 files changed, 1864 insertions(+), 808 deletions(-)
