This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
from d246386 build(deps): bump net.sf.saxon:Saxon-HE from 12.9 to 13.0 (#1)
add 8459034 Make the deny-all entity resolver a non-overridable floor
(Xerces and Android)
add 4caa700 Extract HardeningDocumentBuilderFactory and reuse the
resolver floor
add 04ea092 Add regression test for external schema-location properties
add bd32bbe Make the schema resource resolver a non-overridable floor
add c4566ae Make the transformer URI resolver a non-overridable floor
add b3d8bf8 Make the StAX XML resolver a non-overridable floor
add 4a17b61 Resolve relative systemId before delegating to a plain
EntityResolver
add 619fba4 Clarify the resolver-floor Javadoc
add 66c18ff Document the resolver floor in the threat model
add 0db292f Set the system id on the XInclude test resolver's InputSource
add 9b36075 Use US spelling consistently in comments and docs
add 4814fc8 Merge remote-tracking branch 'apache/main' into
feature/resolver-floor
add ba0272e Guard resolver-property casts in HardeningXMLInputFactory
add 16fe01b fix: sort AttackTestSupport
add a6b7121 fix: simplify HardeningXMLInputFactory
add bec0fb2 Merge Delegating wrappers into their Hardening subclasses
add 84f8a36 Add trailing newline to files missing EOL at EOF
add 863262e Fold DelegatingXMLReader into HardeningXMLReader
add 30fd1f4 Revert EOL
add 3449718 Revert incidental spelling and comma changes
add b309ee3 Revert incidental spelling and wording changes
new 4d960b9 Merge pull request #18 from ppkarwasz/feature/resolver-floor
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../apache/commons/xml/DelegatingSAXParser.java | 88 -----
.../commons/xml/DelegatingSAXParserFactory.java | 94 ------
.../commons/xml/DelegatingSchemaFactory.java | 95 ------
.../apache/commons/xml/DelegatingTemplates.java | 46 ---
.../apache/commons/xml/DelegatingTransformer.java | 104 ------
.../commons/xml/DelegatingTransformerFactory.java | 133 --------
.../commons/xml/DocumentBuilderHardener.java | 28 +-
.../commons/xml/HardeningDocumentBuilder.java | 103 ++++++
...y.java => HardeningDocumentBuilderFactory.java} | 24 +-
.../org/apache/commons/xml/HardeningSAXParser.java | 48 ++-
.../commons/xml/HardeningSAXParserFactory.java | 63 +++-
.../org/apache/commons/xml/HardeningSchema.java | 10 +-
.../apache/commons/xml/HardeningSchemaFactory.java | 77 ++++-
.../org/apache/commons/xml/HardeningTemplates.java | 20 +-
.../apache/commons/xml/HardeningTransformer.java | 86 ++++-
.../commons/xml/HardeningTransformerFactory.java | 95 +++++-
.../org/apache/commons/xml/HardeningValidator.java | 15 +-
.../commons/xml/HardeningValidatorHandler.java | 160 +++++++++
.../commons/xml/HardeningXMLInputFactory.java | 214 ++++++++++++
...atingXMLReader.java => HardeningXMLReader.java} | 45 ++-
.../java/org/apache/commons/xml/Resolvers.java | 291 ++++++++++++----
.../org/apache/commons/xml/SAXParserHardener.java | 83 ++---
.../java/org/apache/commons/xml/StaxHardener.java | 72 ++--
.../apache/commons/xml/TransformerHardener.java | 17 +-
src/site/markdown/threat_model.md | 40 ++-
.../org/apache/commons/xml/AttackTestSupport.java | 48 ++-
.../commons/xml/EntityResolverFloorTest.java | 376 +++++++++++++++++++++
.../commons/xml/SchemaLocationPropertyTest.java | 187 ++++++++++
src/test/resources/leaked/no-namespace.xsd | 5 +
src/test/resources/leaked/with-xinclude.xml | 5 +
30 files changed, 1864 insertions(+), 808 deletions(-)
delete mode 100644
src/main/java/org/apache/commons/xml/DelegatingSAXParser.java
delete mode 100644
src/main/java/org/apache/commons/xml/DelegatingSAXParserFactory.java
delete mode 100644
src/main/java/org/apache/commons/xml/DelegatingSchemaFactory.java
delete mode 100644
src/main/java/org/apache/commons/xml/DelegatingTemplates.java
delete mode 100644
src/main/java/org/apache/commons/xml/DelegatingTransformer.java
delete mode 100644
src/main/java/org/apache/commons/xml/DelegatingTransformerFactory.java
create mode 100644
src/main/java/org/apache/commons/xml/HardeningDocumentBuilder.java
rename
src/main/java/org/apache/commons/xml/{DelegatingDocumentBuilderFactory.java =>
HardeningDocumentBuilderFactory.java} (80%)
create mode 100644
src/main/java/org/apache/commons/xml/HardeningValidatorHandler.java
create mode 100644
src/main/java/org/apache/commons/xml/HardeningXMLInputFactory.java
rename src/main/java/org/apache/commons/xml/{DelegatingXMLReader.java =>
HardeningXMLReader.java} (63%)
create mode 100644
src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java
create mode 100644
src/test/java/org/apache/commons/xml/SchemaLocationPropertyTest.java
create mode 100644 src/test/resources/leaked/no-namespace.xsd
create mode 100644 src/test/resources/leaked/with-xinclude.xml
