This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
from a00db73 Bump ossf/scorecard-action from 2.4.3 to 2.4.4.
add 0e2901a Remove the Limits class
add bf4e084 Refactor BillionLaughsTest payloads
add 9df3143 Lift all three JDK entity limits in the positive controls
add 67353b1 fix: orphan mention of JDK system properties
add 0676eb4 fix: rename assumeSAXLimitConfigurable
add 3abfea5 Fold the Woodstox entity-count lift into liftEntityLimits
add 72df8f7 Split the XSLT payload across two literal result elements
add 55b9b13 Fix `content()` Javadoc
add 02005a2 Merge remote-tracking branch 'apache/main' into
feature/remove-limits-class
add d7e4262 Merge remote-tracking branch 'apache/main' into
feature/remove-limits-class
new 0e21e08 Merge pull request #22 from
ppkarwasz/feature/remove-limits-class
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../commons/xml/DocumentBuilderHardener.java | 4 -
.../java/org/apache/commons/xml/JaxpSetters.java | 22 +-
src/main/java/org/apache/commons/xml/Limits.java | 395 ---------------------
.../org/apache/commons/xml/SAXParserHardener.java | 4 -
.../java/org/apache/commons/xml/StaxHardener.java | 4 -
.../apache/commons/xml/TransformerHardener.java | 4 -
src/site/markdown/threat_model.md | 43 +--
.../org/apache/commons/xml/AttackTestSupport.java | 107 ++++--
.../org/apache/commons/xml/BillionLaughsTest.java | 230 ++++++------
9 files changed, 201 insertions(+), 612 deletions(-)
delete mode 100644 src/main/java/org/apache/commons/xml/Limits.java
