This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a change to branch release
in repository https://gitbox.apache.org/repos/asf/commons-secure-xml.git
omit 157f41e Prepare for the release candidate 1.0.0 RC1
add 8935fb5 fix: add Mockito as Gradle dependency
add 60a0d2a Rework the SAX default parser selection tests.
add ce48b10 Rework the DOM default parser selection test.
add 754b0a1 Disable Mockito-based tests in the native image
add 2457a9a Verify the Gradle wrapper and distribution by checksum
add c716c20 Restructure SECURITY.md into a full security policy (#67)
add a06bb68 Forward getExternalSubset to a caller EntityResolver2 (#68)
add fa90fe8 Resolve each unresolved URI to a fresh empty document (#69)
add 54b8d4b Rethrow JVM errors unchanged in
MethodHandleFactory.invokeExact (#70)
add 8067483 Cover Saxon's unparsed-text family and json-doc on the TrAX
path (#71)
add 6fcb571 Keep the resolver floor on a reader obtained before reset()
(#72)
add 6d40c0e Bound the content model a schema expands into (#73)
add 9192933 Secure getAssociatedStylesheet, and pin the CI Zulu job to
JDK 8u152 (#74)
add 73b6bbf Install a fresh StAX resolver floor per hook instead of
mutating one (#75)
add 632cb04 Delegate the Java 18 XPathFactory property methods (#76)
add 4ae7b9c Package-private FallbackIgnoreEntityResolver2 can be final.
add 7404ac6 Next RC will be RC2.
add 16f4829 Add android-tests to source assembly.
add 18dcc5f Sort members.
add 6e3ec49 Javadoc
add e1dde41 Generate binary assembly.
add 2a70b09 Javadoc
add b08f73e Javadoc
add 1bbbc91 Don't need protected method in final class (#77)
add d536591 Small simplifications (#79)
add c00a066 Copy editing (#80)
add 94898e3 Remove unthrown exceptions (#78)
add 5731ac3 Credit Elliotte Rusty Harold's clean-up in the changelog
add 1ff8851 Use the ASF id in the changelog and the developer entry
add d3aa9ee Remove unused import.
add 1497239 Sharpen the threat model: honored JAXP contracts, XInclude,
and expansion limits (#66)
add 6c2b441 Document resolvers in the Javadoc overview (#81)
add 9d251f7 SchemaContentModelLimitTest.MAX_OCCURS only needs to be just
over 5,000.
add 4a116db Import class instead of using a FQCN.
add 9e86f65 Javadoc @link to our own classes.
add 8a000f4 Javadoc @link to our own classes.
add 7107fa1 Fix broken English.
add e0e1f16 Split the Security and Threat Model pages (#83)
add 61fe771 Fix the site test report and count Android in the coverage
(#82)
add 7500241 Javadoc (grammar)
add 8c504c7 Javadoc @see tag not needed here.
add ca6d879 Javadoc (grammar)
add 1347744 Normalize spelling.
add e9e08a0 Javadoc: Fix word salad
add db2cbe0 Javadoc: Fix word salad.
add b5c4d3d Javadoc
add 26a9e3a Fix inline comment
add dcb1af1 FIx Javadoc @param description
add 8af1672 Javadoc
add 92724fb Javadoc
add 8fc0beb Normalize Javadoc `@throws`.
add 7602db1 Normalize Javadoc `@param`.
add 2257207 Better table description
add 10b4451 Fix HTML links
add f53794b Bump commons.graalvm.buildtools.version from 1.1.10 to 1.1.11
(#85)
add 15e2597 Prepare for the release candidate
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (157f41e)
\
N -- N -- N refs/heads/release (15e2597)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
No new revisions were added by this update.
Summary of changes:
.github/workflows/maven.yml | 11 +-
RELEASE-NOTES.txt | 3 +
SECURITY.md | 32 +-
android-tests/README.md | 84 +++-
android-tests/build.gradle.kts | 12 +
.../gradle/wrapper/gradle-wrapper.properties | 1 +
pom.xml | 114 +++++-
src/assembly/src.xml | 6 +-
src/changes/changes.xml | 39 +-
.../xml/secure/FallbackIgnoreEntityResolver2.java | 29 +-
.../xml/secure/FallbackIgnoreURIResolver.java | 44 +-
.../xml/secure/FallbackIgnoreXMLResolver.java | 5 +-
.../commons/xml/secure/MethodHandleFactory.java | 39 +-
.../commons/xml/secure/SecureDocumentBuilder.java | 4 +-
.../xml/secure/SecureDocumentBuilderFactory.java | 29 +-
.../apache/commons/xml/secure/SecureException.java | 18 +-
.../apache/commons/xml/secure/SecureSAXParser.java | 17 +-
.../commons/xml/secure/SecureSAXParserFactory.java | 33 +-
.../apache/commons/xml/secure/SecureSchema.java | 4 +-
.../commons/xml/secure/SecureSchemaFactory.java | 72 ++--
.../apache/commons/xml/secure/SecureTemplates.java | 10 +-
.../commons/xml/secure/SecureTemplatesHandler.java | 8 +-
.../commons/xml/secure/SecureTransformer.java | 8 +-
.../xml/secure/SecureTransformerFactory.java | 117 ++++--
.../xml/secure/SecureTransformerHandler.java | 10 +-
.../apache/commons/xml/secure/SecureValidator.java | 4 +-
.../commons/xml/secure/SecureValidatorHandler.java | 4 +-
.../apache/commons/xml/secure/SecureXMLFilter.java | 8 +-
.../commons/xml/secure/SecureXMLInputFactory.java | 63 +--
.../apache/commons/xml/secure/SecureXMLReader.java | 12 +-
.../org/apache/commons/xml/secure/SecureXPath.java | 8 +-
.../commons/xml/secure/SecureXPathExpression.java | 4 +-
.../commons/xml/secure/SecureXPathFactory.java | 80 +++-
.../apache/commons/xml/secure/package-info.java | 12 +-
src/main/javadoc/overview.html | 237 ++++++++---
src/site/markdown/security.md | 58 +++
src/site/markdown/threat_model.md | 442 +++++++++++++--------
src/site/site.xml | 2 +-
src/site/xdoc/security.xml | 64 ---
.../xml/secure/AccessExternalPropertyTest.java | 2 +-
.../xml/secure/AssociatedStylesheetTest.java | 63 ++-
.../commons/xml/secure/AttackTestSupport.java | 48 +--
.../commons/xml/secure/BillionLaughsTest.java | 4 +-
.../commons/xml/secure/DenyUnresolvedTest.java | 2 +-
.../apache/commons/xml/secure/DoctypeOnlyTest.java | 2 +-
.../xml/secure/EntityResolverFloorTest.java | 4 +-
.../apache/commons/xml/secure/ExternalDtdTest.java | 2 +-
.../xml/secure/ExternalGeneralEntityTest.java | 2 +-
.../xml/secure/ExternalParameterEntityTest.java | 4 +-
.../secure/FallbackIgnoreEntityResolver2Test.java | 18 +
.../xml/secure/FallbackIgnoreURIResolverTest.java | 22 +-
.../xml/secure/MethodHandleFactoryTest.java | 17 +-
.../apache/commons/xml/secure/NoDoctypeTest.java | 2 +-
.../xml/secure/OverrideDefaultParserTest.java | 24 +-
.../apache/commons/xml/secure/ResetSecureTest.java | 19 +-
.../xml/secure/SaxonAlternateFactoryTest.java | 2 +-
.../secure/SaxonTransformerExternalCallsTest.java | 181 +++++++++
.../xml/secure/SaxonXPathExternalCallsTest.java | 4 +-
.../xml/secure/SchemaContentModelLimitTest.java | 95 +++++
.../xml/secure/SchemaFactoryLanguageTest.java | 2 +-
.../commons/xml/secure/SchemaImportTest.java | 2 +-
.../commons/xml/secure/SchemaIncludeTest.java | 2 +-
.../commons/xml/secure/SchemaLocationDomTest.java | 2 +-
.../xml/secure/SchemaLocationPropertyTest.java | 2 +-
.../commons/xml/secure/SchemaLocationSaxTest.java | 2 +-
.../commons/xml/secure/SchemaRedefineTest.java | 2 +-
.../secure/SecureDocumentBuilderFactoryTest.java | 67 +++-
.../xml/secure/SecureFactoriesSmokeTest.java | 4 +-
.../xml/secure/SecureSAXParserFactoryTest.java | 135 +++++--
.../commons/xml/secure/SecureSAXParserTest.java | 11 +-
.../xml/secure/SecureTransformerFactoryTest.java | 2 +-
.../xml/secure/SecureValidatorHandlerTest.java | 4 +-
.../commons/xml/secure/SecureXMLFilterTest.java | 36 +-
.../xml/secure/SecureXMLInputFactoryTest.java | 45 ++-
.../commons/xml/secure/SecureXPathFactoryTest.java | 43 ++
.../apache/commons/xml/secure/SecureXPathTest.java | 2 +-
.../commons/xml/secure/TemplatesImportTest.java | 2 +-
.../commons/xml/secure/TemplatesIncludeTest.java | 2 +-
.../xml/secure/TransformerDocumentTest.java | 2 +-
.../apache/commons/xml/secure/XIncludeTest.java | 6 +-
.../commons/xml/secure/XPathInputSourceTest.java | 2 +-
81 files changed, 1900 insertions(+), 741 deletions(-)
create mode 100644 src/site/markdown/security.md
delete mode 100644 src/site/xdoc/security.xml
create mode 100644
src/test/java/org/apache/commons/xml/secure/SaxonTransformerExternalCallsTest.java
create mode 100644
src/test/java/org/apache/commons/xml/secure/SchemaContentModelLimitTest.java
