This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
from 6f1cdca Merge pull request #32 from
apache/feature/schema-factory-language
add 13e0b74 Centralize hardening messages on HardeningException
add b5267e1 Inline the typed JAXP setters into each hardener
add 5bb6e89 Split the resolver floors into top-level classes
add 4c59616 Break the XmlFactories cycle for TrAX, XPath and schema
add 6a547ef Add SchemaHardener as the schema entry point
add 0fcd0a1 Disable ShadingFootprintTest in a native image
add 7ba0341 Make the resolver floors ignore-all instead of deny-all
add 848d55e Drop XERCES_LOAD_EXTERNAL_DTD from the hardening recipes
add 61d3b23 Extend the ignore-all floor to Saxon resource resolution
add 672780d Tidy the HardenedConfiguration comments
add 49e22d5 Reuse the shared character-capture helpers in tests
add 673ea4a Reuse the shared StAX capture helper in
EntityResolverFloorTest
add 52194eb Resolve ignored URIs to an empty document instead of an empty
stream
add 42347e9 Tighten the TrAX leak assertions
add 7ca43ba Judge blocked TrAX outcomes with a ThrowingConsumer
add ce9c4af Name the external-entity tests after their assertions
add 56ae530 Drop the Woodstox undeclared-entity floor
add 79d5e53 Add a toggle to reject unresolved external references
add 9278083 Reuse the forbidden message for rejected resolutions
add d962e4c Document the ignore-all contract on the site index
add c0cbe70 Merge remote-tracking branch 'apache/main' into
feature/reduce-shade-footprint
add bc0fa18 Merge branch 'feature/reduce-shade-footprint' into
feature/ignore-all-resolver-floors
add 5c7688c fix: number of expected classes
add cc78d16 Merge branch 'feature/reduce-shade-footprint' into
feature/ignore-all-resolver-floors
new 3337304 Merge pull request #30 from
apache/feature/ignore-all-resolver-floors
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
android-tests/build.gradle.kts | 5 +
pom.xml | 9 +
.../commons/xml/DocumentBuilderHardener.java | 24 +-
.../commons/xml/FallbackIgnoreEntityResolver2.java | 141 ++++++++++
.../xml/FallbackIgnoreLSResourceResolver.java | 83 ++++++
.../commons/xml/FallbackIgnoreURIResolver.java | 80 ++++++
.../commons/xml/FallbackIgnoreXMLResolver.java | 67 +++++
.../commons/xml/HardeningDocumentBuilder.java | 8 +-
.../xml/HardeningDocumentBuilderFactory.java | 2 +-
.../org/apache/commons/xml/HardeningException.java | 43 ++-
.../org/apache/commons/xml/HardeningSchema.java | 2 +-
.../apache/commons/xml/HardeningSchemaFactory.java | 8 +-
.../apache/commons/xml/HardeningTransformer.java | 10 +-
.../commons/xml/HardeningTransformerFactory.java | 10 +-
.../org/apache/commons/xml/HardeningValidator.java | 10 +-
.../commons/xml/HardeningValidatorHandler.java | 6 +-
.../commons/xml/HardeningXMLInputFactory.java | 25 +-
.../org/apache/commons/xml/HardeningXMLReader.java | 16 +-
.../java/org/apache/commons/xml/JaxpSetters.java | 151 ----------
.../java/org/apache/commons/xml/Resolvers.java | 313 ---------------------
.../org/apache/commons/xml/SAXParserHardener.java | 133 ++++-----
.../java/org/apache/commons/xml/SaxonProvider.java | 73 ++++-
.../org/apache/commons/xml/SchemaHardener.java | 53 ++++
.../java/org/apache/commons/xml/StaxHardener.java | 61 +---
.../apache/commons/xml/TransformerHardener.java | 20 +-
.../java/org/apache/commons/xml/XPathHardener.java | 19 +-
.../java/org/apache/commons/xml/XmlFactories.java | 35 +--
src/site/markdown/index.md | 45 ++-
src/site/markdown/threat_model.md | 11 +-
.../org/apache/commons/xml/AttackTestSupport.java | 114 ++++++--
.../org/apache/commons/xml/DenyUnresolvedTest.java | 62 ++++
.../commons/xml/EntityResolverFloorTest.java | 131 ++++-----
.../org/apache/commons/xml/ExternalDtdTest.java | 17 +-
.../commons/xml/ExternalGeneralEntityTest.java | 40 +--
.../commons/xml/ExternalParameterEntityTest.java | 42 +--
.../apache/commons/xml/SchemaLocationDomTest.java | 28 +-
.../commons/xml/SchemaLocationPropertyTest.java | 2 +-
.../apache/commons/xml/SchemaLocationSaxTest.java | 31 +-
.../apache/commons/xml/ShadingFootprintTest.java | 205 ++++++++++++++
.../apache/commons/xml/TemplatesImportTest.java | 2 +-
.../apache/commons/xml/TemplatesIncludeTest.java | 2 +-
.../commons/xml/TransformerDocumentTest.java | 2 +-
.../java/org/apache/commons/xml/XIncludeTest.java | 106 +++----
43 files changed, 1307 insertions(+), 940 deletions(-)
create mode 100644
src/main/java/org/apache/commons/xml/FallbackIgnoreEntityResolver2.java
create mode 100644
src/main/java/org/apache/commons/xml/FallbackIgnoreLSResourceResolver.java
create mode 100644
src/main/java/org/apache/commons/xml/FallbackIgnoreURIResolver.java
create mode 100644
src/main/java/org/apache/commons/xml/FallbackIgnoreXMLResolver.java
delete mode 100644 src/main/java/org/apache/commons/xml/JaxpSetters.java
delete mode 100644 src/main/java/org/apache/commons/xml/Resolvers.java
create mode 100644 src/main/java/org/apache/commons/xml/SchemaHardener.java
create mode 100644 src/test/java/org/apache/commons/xml/DenyUnresolvedTest.java
create mode 100644
src/test/java/org/apache/commons/xml/ShadingFootprintTest.java
