This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 4d61f562ea5b1125e3ed103ba206eeb34f808053 Merge: c7b7747 1ce0ab7 Author: Gary Gregory <[email protected]> AuthorDate: Tue Aug 18 15:44:13 2026 -0400 Merge pull request #40 from ppkarwasz/docs/saxtransformerfactory-out-of-scope docs: declare the SAXTransformerFactory extension surface out of scope src/main/java/org/apache/commons/xml/XmlFactories.java | 10 +++++++++- src/site/markdown/index.md | 10 ++++++++++ src/site/markdown/threat_model.md | 15 ++++++++++++++- 3 files changed, 33 insertions(+), 2 deletions(-) diff --cc src/site/markdown/threat_model.md index 7dd74c0,961ab32..fa5154e --- a/src/site/markdown/threat_model.md +++ b/src/site/markdown/threat_model.md @@@ -209,8 -210,17 +210,16 @@@ and reports against a factory reconfigu or a `DOMSource` holding a document parsed elsewhere. Its settings are yours, including permissive ones. To parse with your own reader under the hardening guarantees, - route it through `XmlFactories.harden(XMLReader)` - (or build it from `XmlFactories.newSAXParserFactory()`) + obtain it from `XmlFactories.newSAXParserFactory()` before wrapping it in a `SAXSource`. + - **`SAXTransformerFactory` extension methods.** + Only the `TransformerFactory` API of the factory returned by `XmlFactories.newTransformerFactory()` is covered. + The `SAXTransformerFactory` extension methods, + `newTransformerHandler(...)`, `newTemplatesHandler()` and `newXMLFilter(...)`, + if reachable by casting the returned factory, + and the `TransformerHandler`, `TemplatesHandler`, `Templates` and `XMLFilter` objects they produce, + are not hardened in this release. + Parse their input through a hardened `XmlFactories` parser, or treat it as trusted. - The behavior of a JAXP implementation that `XmlFactories` does not recognize (it throws rather than returning an unhardened factory), and any defect in the underlying JAXP implementation itself.
