This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 87eff6d475da424a5935515184f1b1ab5661411e Merge: 125a1a3 27d80d8 Author: Gary Gregory <[email protected]> AuthorDate: Thu Aug 20 08:20:22 2026 -0400 Merge pull request #38 from ppkarwasz/docs/supported-runtime-floor docs: document the supported-runtime floor (OpenJDK 8+) .../java/org/apache/commons/xml/XmlFactories.java | 8 +++- src/site/markdown/index.md | 12 ++++++ src/site/markdown/threat_model.md | 47 +++++++++++++++++----- 3 files changed, 56 insertions(+), 11 deletions(-) diff --cc src/site/markdown/threat_model.md index fa5154e,cb293f6..6394361 --- a/src/site/markdown/threat_model.md +++ b/src/site/markdown/threat_model.md @@@ -74,11 -74,11 +74,12 @@@ because your reader's settings are indi ### What is in scope - - The hardening recipes applied by `XmlFactories` to the JAXP implementations it recognizes (stock JDK, Apache Xerces, - Xalan, Saxon, Woodstox, and Android's Expat/KXmlParser). + - The hardening recipes applied by `XmlFactories` to the JAXP implementations it recognizes (stock JDK, Apache Xerces, Xalan, Saxon, and Woodstox). + The recipes for Android's Expat/KXmlParser are applied as best-effort and carry no guarantee + (see **Supported runtimes** under [Assumptions about the environment](#assumptions-about-the-environment)). - A factory returned by `XmlFactories`, used as delivered, that fails to provide a guarantee the Javadoc states it - provides. + provides. The guarantee covers the documented entry points of each returned factory type; the + `SAXTransformerFactory` extension methods are out of scope (see [What is out of scope](#what-is-out-of-scope)). ### Assumptions about the environment @@@ -210,18 -227,15 +228,22 @@@ and reports against a factory reconfigu or a `DOMSource` holding a document parsed elsewhere. Its settings are yours, including permissive ones. To parse with your own reader under the hardening guarantees, - route it through `XmlFactories.harden(XMLReader)` - (or build it from `XmlFactories.newSAXParserFactory()`) + obtain it from `XmlFactories.newSAXParserFactory()` before wrapping it in a `SAXSource`. +- **`SAXTransformerFactory` extension methods.** + Only the `TransformerFactory` API of the factory returned by `XmlFactories.newTransformerFactory()` is covered. + The `SAXTransformerFactory` extension methods, + `newTransformerHandler(...)`, `newTemplatesHandler()` and `newXMLFilter(...)`, + if reachable by casting the returned factory, + and the `TransformerHandler`, `TemplatesHandler`, `Templates` and `XMLFilter` objects they produce, + are not hardened in this release. + Parse their input through a hardened `XmlFactories` parser, or treat it as trusted. - The behavior of a JAXP implementation that `XmlFactories` does not recognize (it throws rather than returning an unhardened factory), and any defect in the underlying JAXP implementation itself. + - **Android, on any API level.** + No version of Android supports `FEATURE_SECURE_PROCESSING`, + so the hardening there is best-effort and no guarantee is defined + (see **Supported runtimes** under [Assumptions about the environment](#assumptions-about-the-environment)). ### Downstream responsibility
