rubenada commented on code in PR #2892:
URL: https://github.com/apache/calcite/pull/2892#discussion_r963054866
##########
core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java:
##########
@@ -60,11 +67,24 @@
public class XmlFunctions {
private static final ThreadLocal<@Nullable XPathFactory> XPATH_FACTORY =
- ThreadLocal.withInitial(XPathFactory::newInstance);
+ ThreadLocal.withInitial(() -> {
+ final XPathFactory xPathFactory = XPathFactory.newInstance();
+ try {
+ xPathFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
true);
+ } catch (XPathFactoryConfigurationException e) {
+ throw new IllegalStateException("XPath Factory configuration
failed", e);
Review Comment:
So, if I understand it correctly, we are breaking applications that cannot
create a secure XPathFactory and which require such factory because they are
calling an xml operator. If an application cannot create a secure XPathFactory
but does not make use of xml operators, it will be fine.
If this is the case, I think we should leave the code as it is: if an xml
operation is invoked, it needs to be done via a secure factory, that seems like
the safest approach.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
