This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a change to branch feature/reduce-shade-footprint
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
from 5c7688c fix: number of expected classes
add 7ba0341 Make the resolver floors ignore-all instead of deny-all
add 848d55e Drop XERCES_LOAD_EXTERNAL_DTD from the hardening recipes
add 61d3b23 Extend the ignore-all floor to Saxon resource resolution
add 672780d Tidy the HardenedConfiguration comments
add 49e22d5 Reuse the shared character-capture helpers in tests
add 673ea4a Reuse the shared StAX capture helper in
EntityResolverFloorTest
add 52194eb Resolve ignored URIs to an empty document instead of an empty
stream
add 42347e9 Tighten the TrAX leak assertions
add 7ca43ba Judge blocked TrAX outcomes with a ThrowingConsumer
add ce9c4af Name the external-entity tests after their assertions
add 56ae530 Drop the Woodstox undeclared-entity floor
add 79d5e53 Add a toggle to reject unresolved external references
add 9278083 Reuse the forbidden message for rejected resolutions
add d962e4c Document the ignore-all contract on the site index
add bc0fa18 Merge branch 'feature/reduce-shade-footprint' into
feature/ignore-all-resolver-floors
add cc78d16 Merge branch 'feature/reduce-shade-footprint' into
feature/ignore-all-resolver-floors
add 751cb71 Remove the harden(XMLReader) and harden(Source) methods from
the public API
new c457f0f Merge pull request #34 from apache/remove/harden-source
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../commons/xml/DocumentBuilderHardener.java | 21 +---
.../xml/FallbackDenyLSResourceResolver.java | 55 ---------
.../commons/xml/FallbackDenyXMLResolver.java | 84 -------------
...er2.java => FallbackIgnoreEntityResolver2.java} | 44 ++++---
.../xml/FallbackIgnoreLSResourceResolver.java | 83 +++++++++++++
...esolver.java => FallbackIgnoreURIResolver.java} | 36 +++++-
.../commons/xml/FallbackIgnoreXMLResolver.java | 32 ++++-
.../commons/xml/HardeningDocumentBuilder.java | 8 +-
.../xml/HardeningDocumentBuilderFactory.java | 2 +-
.../org/apache/commons/xml/HardeningException.java | 19 ++-
.../org/apache/commons/xml/HardeningSchema.java | 4 +-
.../apache/commons/xml/HardeningSchemaFactory.java | 10 +-
.../apache/commons/xml/HardeningTransformer.java | 8 +-
.../commons/xml/HardeningTransformerFactory.java | 6 +-
.../org/apache/commons/xml/HardeningValidator.java | 8 +-
.../commons/xml/HardeningValidatorHandler.java | 6 +-
.../commons/xml/HardeningXMLInputFactory.java | 25 ++--
.../org/apache/commons/xml/HardeningXMLReader.java | 16 +--
.../org/apache/commons/xml/SAXParserHardener.java | 102 ++--------------
.../java/org/apache/commons/xml/SaxonProvider.java | 71 +++++++++--
.../org/apache/commons/xml/SchemaHardener.java | 2 +-
.../java/org/apache/commons/xml/StaxHardener.java | 67 +----------
.../apache/commons/xml/TransformerHardener.java | 10 +-
.../java/org/apache/commons/xml/XmlFactories.java | 33 ++----
src/site/markdown/index.md | 45 ++++++-
src/site/markdown/threat_model.md | 11 +-
.../org/apache/commons/xml/AttackTestSupport.java | 124 +++++++++++++++----
.../org/apache/commons/xml/DenyUnresolvedTest.java | 62 ++++++++++
.../commons/xml/EntityResolverFloorTest.java | 131 ++++++++++-----------
.../org/apache/commons/xml/ExternalDtdTest.java | 17 ++-
.../commons/xml/ExternalGeneralEntityTest.java | 40 ++++---
.../commons/xml/ExternalParameterEntityTest.java | 42 ++++---
.../apache/commons/xml/SchemaLocationDomTest.java | 28 ++---
.../commons/xml/SchemaLocationPropertyTest.java | 2 +-
.../apache/commons/xml/SchemaLocationSaxTest.java | 31 +++--
.../apache/commons/xml/ShadingFootprintTest.java | 21 ++--
.../apache/commons/xml/TemplatesImportTest.java | 2 +-
.../apache/commons/xml/TemplatesIncludeTest.java | 2 +-
.../commons/xml/TransformerDocumentTest.java | 2 +-
.../java/org/apache/commons/xml/XIncludeTest.java | 118 +++++++------------
40 files changed, 741 insertions(+), 689 deletions(-)
delete mode 100644
src/main/java/org/apache/commons/xml/FallbackDenyLSResourceResolver.java
delete mode 100644
src/main/java/org/apache/commons/xml/FallbackDenyXMLResolver.java
rename src/main/java/org/apache/commons/xml/{FallbackDenyEntityResolver2.java
=> FallbackIgnoreEntityResolver2.java} (73%)
create mode 100644
src/main/java/org/apache/commons/xml/FallbackIgnoreLSResourceResolver.java
rename src/main/java/org/apache/commons/xml/{FallbackDenyURIResolver.java =>
FallbackIgnoreURIResolver.java} (51%)
create mode 100644 src/test/java/org/apache/commons/xml/DenyUnresolvedTest.java
