This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit b1a85ef9738016a1c4b00165a568e0d72ec4cc5d Merge: 87eff6d 0aeac4b Author: Gary Gregory <[email protected]> AuthorDate: Thu Aug 20 08:22:09 2026 -0400 Merge pull request #41 from ppkarwasz/feature/harden-saxtransformerfactory Harden the SAXTransformerFactory extension surface .../commons/xml/FallbackIgnoreURIResolver.java | 26 ++- .../org/apache/commons/xml/HardeningTemplates.java | 19 ++- .../commons/xml/HardeningTemplatesHandler.java | 128 +++++++++++++++ .../apache/commons/xml/HardeningTransformer.java | 5 +- .../commons/xml/HardeningTransformerFactory.java | 80 ++++++---- .../commons/xml/HardeningTransformerHandler.java | 174 +++++++++++++++++++++ .../org/apache/commons/xml/HardeningXMLFilter.java | 76 +++++++++ .../org/apache/commons/xml/SAXParserHardener.java | 27 ++-- .../java/org/apache/commons/xml/SaxonProvider.java | 74 +++------ .../apache/commons/xml/TransformerHardener.java | 14 +- .../java/org/apache/commons/xml/XmlFactories.java | 8 +- src/site/markdown/index.md | 11 +- src/site/markdown/threat_model.md | 16 +- .../org/apache/commons/xml/AttackTestSupport.java | 17 +- .../apache/commons/xml/SaxSurfaceTestSupport.java | 70 +++++++++ .../apache/commons/xml/ShadingFootprintTest.java | 7 +- .../apache/commons/xml/TemplatesHandlerTest.java | 77 +++++++++ .../apache/commons/xml/TransformerHandlerTest.java | 85 ++++++++++ .../java/org/apache/commons/xml/XMLFilterTest.java | 119 ++++++++++++++ 19 files changed, 900 insertions(+), 133 deletions(-) diff --cc src/site/markdown/threat_model.md index 6394361,7c9d63d..6c5bac4 --- a/src/site/markdown/threat_model.md +++ b/src/site/markdown/threat_model.md @@@ -74,12 -74,11 +74,12 @@@ because your reader's settings are indi ### What is in scope -- The hardening recipes applied by `XmlFactories` to the JAXP implementations it recognizes (stock JDK, Apache Xerces, - Xalan, Saxon, Woodstox, and Android's Expat/KXmlParser). +- The hardening recipes applied by `XmlFactories` to the JAXP implementations it recognizes (stock JDK, Apache Xerces, Xalan, Saxon, and Woodstox). + The recipes for Android's Expat/KXmlParser are applied as best-effort and carry no guarantee + (see **Supported runtimes** under [Assumptions about the environment](#assumptions-about-the-environment)). - A factory returned by `XmlFactories`, used as delivered, that fails to provide a guarantee the Javadoc states it - provides. The guarantee covers the documented entry points of each returned factory type; the - `SAXTransformerFactory` extension methods are out of scope (see [What is out of scope](#what-is-out-of-scope)). + provides. The guarantee covers the documented entry points of each returned factory type, + including the `SAXTransformerFactory` extension methods when the returned `TransformerFactory` exposes them. ### Assumptions about the environment @@@ -230,20 -212,8 +230,12 @@@ and reports against a factory reconfigu To parse with your own reader under the hardening guarantees, obtain it from `XmlFactories.newSAXParserFactory()` before wrapping it in a `SAXSource`. - - **`SAXTransformerFactory` extension methods.** - Only the `TransformerFactory` API of the factory returned by `XmlFactories.newTransformerFactory()` is covered. - The `SAXTransformerFactory` extension methods, - `newTransformerHandler(...)`, `newTemplatesHandler()` and `newXMLFilter(...)`, - if reachable by casting the returned factory, - and the `TransformerHandler`, `TemplatesHandler`, `Templates` and `XMLFilter` objects they produce, - are not hardened in this release. - Parse their input through a hardened `XmlFactories` parser, or treat it as trusted. - The behavior of a JAXP implementation that `XmlFactories` does not recognize (it throws rather than returning an unhardened factory), and any defect in the underlying JAXP implementation itself. +- **Android, on any API level.** + No version of Android supports `FEATURE_SECURE_PROCESSING`, + so the hardening there is best-effort and no guarantee is defined + (see **Supported runtimes** under [Assumptions about the environment](#assumptions-about-the-environment)). ### Downstream responsibility
