This is an automated email from the ASF dual-hosted git repository. ppkarwasz pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit fb3d24f7da432f1ad5a7ba008e0c24275b32dc85 Author: Piotr P. Karwasz <[email protected]> AuthorDate: Sat Apr 25 12:48:51 2026 +0200 fix: allow external access via system properties To be sure tests pass because of our hardening and not accidental system defaults, we relax those defaults via system properties. --- pom.xml | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/pom.xml b/pom.xml index 86e5d50..0bb7091 100644 --- a/pom.xml +++ b/pom.xml @@ -81,13 +81,28 @@ Run the test suite four times, each with exactly one JAXP implementation on the classpath: - test-stockjdk: stock JDK factories only - - test-xerces: stock JDK + external Apache Xerces (stashed until XercesProvider lands) - - test-woodstox: stock JDK + Woodstox (StAX) (stashed until WoodstoxProvider lands) - - test-saxon: stock JDK + Saxon-HE (TrAX, XPath) (stashed until SaxonProvider lands) + - test-xerces: stock JDK + external Apache Xerces + - test-woodstox: stock JDK + Woodstox (StAX) + - test-saxon: stock JDK + Saxon-HE (TrAX, XPath) --> <plugin> <groupId>org.apache.maven.plugins</groupId> <artifactId>maven-surefire-plugin</artifactId> + <!-- + Make the underlying JAXP factories as permissive as the JDK allows. Hardened factories produced by + XmlFactories should still block every attack the test suite throws at them; if a test passes only + because the JDK's defaults intervened, we want it to fail here so the gap shows up. + + Inherited by every execution defined below. + --> + <configuration> + <systemPropertyVariables> + <!-- Allow all protocols for external DTDs, schemas, and stylesheets. --> + <javax.xml.accessExternalDTD>all</javax.xml.accessExternalDTD> + <javax.xml.accessExternalSchema>all</javax.xml.accessExternalSchema> + <javax.xml.accessExternalStylesheet>all</javax.xml.accessExternalStylesheet> + </systemPropertyVariables> + </configuration> <executions> <execution> <id>default-test</id>
