This is an automated email from the ASF dual-hosted git repository. ppkarwasz pushed a commit to branch feature/reduce-shade-footprint in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit ce1c303dc04ba0097da01334e0d4ca75e42c5810 Author: Piotr P. Karwasz <[email protected]> AuthorDate: Sat Aug 1 17:10:41 2026 +0200 Add SchemaHardener as the schema entry point Give schema validation the same shape as the other JAXP types: a dedicated hardener class that XmlFactories delegates to, instead of newSchemaFactory wrapping HardeningSchemaFactory directly. The class stays package-private like the other hardeners; it will back a public entry point if the hardeners are exposed later. Pin SchemaHardener as the schema entry point in ShadingFootprintTest. Assisted-By: Claude Fable 5 <[email protected]> --- .../org/apache/commons/xml/SchemaHardener.java | 53 ++++++++++++++++++++++ .../java/org/apache/commons/xml/XmlFactories.java | 2 +- .../apache/commons/xml/ShadingFootprintTest.java | 12 ++--- 3 files changed, 60 insertions(+), 7 deletions(-) diff --git a/src/main/java/org/apache/commons/xml/SchemaHardener.java b/src/main/java/org/apache/commons/xml/SchemaHardener.java new file mode 100644 index 0000000..b836414 --- /dev/null +++ b/src/main/java/org/apache/commons/xml/SchemaHardener.java @@ -0,0 +1,53 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.commons.xml; + +import javax.xml.validation.SchemaFactory; + +/** + * Hardening for any {@link SchemaFactory} on the classpath. + * + * <p>Unlike the other hardeners there is no per-implementation branching and no feature or limit configuration on the factory itself: schema compilation and + * validation reach external resources only through the resolver hook, so wrapping the factory with a non-removable deny-all resolver floor is enough on every + * implementation. The reader used to parse schema and instance documents is hardened separately, through + * {@link SAXParserHardener#hardenSource(javax.xml.transform.Source)}.</p> + */ +final class SchemaHardener { + + /** + * Hardens an existing {@link SchemaFactory}. + * + * <p>Beyond the three universal guarantees (no external DTD fetch, no external entity resolution, bounded internal entity expansion):</p> + * <ul> + * <li>{@code xs:import}, {@code xs:include} and {@code xs:redefine} schemaLocation URIs are not resolved during schema compilation, and</li> + * <li>{@code xsi:schemaLocation} / {@code xsi:noNamespaceSchemaLocation} hints in instance documents are not resolved during validation.</li> + * </ul> + * + * <p>The same guarantees apply to {@link javax.xml.validation.Validator} and {@link javax.xml.validation.ValidatorHandler} instances produced from the + * resulting {@link javax.xml.validation.Schema}.</p> + * + * @param factory the factory to harden; never {@code null}. + * @return a hardened factory. + */ + static SchemaFactory harden(final SchemaFactory factory) { + return new HardeningSchemaFactory(factory); + } + + private SchemaHardener() { + } +} diff --git a/src/main/java/org/apache/commons/xml/XmlFactories.java b/src/main/java/org/apache/commons/xml/XmlFactories.java index a1d1358..810a37c 100644 --- a/src/main/java/org/apache/commons/xml/XmlFactories.java +++ b/src/main/java/org/apache/commons/xml/XmlFactories.java @@ -143,7 +143,7 @@ public static SAXParserFactory newSAXParserFactory() { * @return A hardened factory. */ public static SchemaFactory newSchemaFactory() { - return new HardeningSchemaFactory(SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI)); + return SchemaHardener.harden(SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI)); } /** diff --git a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java index 2aa7c6a..d641314 100644 --- a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java +++ b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java @@ -72,19 +72,19 @@ class ShadingFootprintTest { private static final Set<String> XPATH_HARDENER = saxParsersHardenerPlus("XPathHardener", "SaxonProvider", "SaxonProvider$1", "SaxonProvider$HardenedConfiguration", "SaxonProvider$SaxonProviderConfigurer"); - private static final Set<String> SCHEMA_FACTORY = saxParsersHardenerPlus("HardeningSchemaFactory", "HardeningValidator", "HardeningValidatorHandler", - "HardeningSchema", "FallbackDenyLSResourceResolver"); + private static final Set<String> SCHEMA_HARDENER = saxParsersHardenerPlus("SchemaHardener", "HardeningSchemaFactory", "HardeningValidator", + "HardeningValidatorHandler", "HardeningSchema", "FallbackDenyLSResourceResolver"); /** * Only the public {@link XmlFactories} entry, which news up every hardener, still pulls the whole library; this is its class count. */ - private static final int WHOLE_LIBRARY_SIZE = 32; + private static final int WHOLE_LIBRARY_SIZE = 33; /** * Entry points reported by the {@link #reportFootprint()} diagnostic, most-focused first, ending with the whole library. */ private static final String[] REPORTED = {"DocumentBuilderHardener", "SAXParserHardener", "StaxHardener", "TransformerHardener", "XPathHardener", - "HardeningSchemaFactory", "XmlFactories"}; + "SchemaHardener", "XmlFactories"}; private static Clazzpath clazzpath; private static Path classesDir; @@ -138,8 +138,8 @@ void xPathHardenerFootprint() { } @Test - void schemaFactoryFootprint() { - assertEquals(SCHEMA_FACTORY, closureOf("HardeningSchemaFactory")); + void schemaHardenerFootprint() { + assertEquals(SCHEMA_HARDENER, closureOf("SchemaHardener")); } @Test
