This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 4b02adf7968e7153a828f6c28fdda3aa71c9ed97 Author: Gary Gregory <[email protected]> AuthorDate: Fri Aug 28 13:13:22 2026 -0400 Rename HardeningDocumentBuilderFactory to SecureDocumentBuilderFactory. --- .../commons/xml/HardeningTransformerFactory.java | 2 +- .../org/apache/commons/xml/HardeningXPath.java | 2 +- ...tory.java => SecureDocumentBuilderFactory.java} | 4 ++-- src/site/markdown/index.md | 2 +- .../org/apache/commons/xml/AttackTestSupport.java | 12 +++++----- .../commons/xml/EntityResolverFloorTest.java | 4 ++-- .../commons/xml/HardeningFactoriesSmokeTest.java | 28 +++++++++++----------- .../org/apache/commons/xml/ResetHardeningTest.java | 2 +- .../apache/commons/xml/SchemaLocationDomTest.java | 2 +- .../commons/xml/SchemaLocationPropertyTest.java | 2 +- .../apache/commons/xml/ShadingFootprintTest.java | 26 ++++++++++---------- .../xml/UnsupportedXmlImplementationTest.java | 2 +- .../java/org/apache/commons/xml/XIncludeTest.java | 10 ++++---- 13 files changed, 49 insertions(+), 49 deletions(-) diff --git a/src/main/java/org/apache/commons/xml/HardeningTransformerFactory.java b/src/main/java/org/apache/commons/xml/HardeningTransformerFactory.java index 0908aa6..242c5ec 100644 --- a/src/main/java/org/apache/commons/xml/HardeningTransformerFactory.java +++ b/src/main/java/org/apache/commons/xml/HardeningTransformerFactory.java @@ -234,7 +234,7 @@ private Source hardenSourceToDom(final Source source) throws TransformerConfigur final InputSource inputSource = SAXSource.sourceToInputSource(source); if (inputSource != null) { try { - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newNSInstance(overrideDefaultParser()); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(overrideDefaultParser()); final Document document = factory.newDocumentBuilder().parse(inputSource); return new DOMSource(document, inputSource.getSystemId()); } catch (final ParserConfigurationException | SAXException | IOException e) { diff --git a/src/main/java/org/apache/commons/xml/HardeningXPath.java b/src/main/java/org/apache/commons/xml/HardeningXPath.java index f36042d..724aaa3 100644 --- a/src/main/java/org/apache/commons/xml/HardeningXPath.java +++ b/src/main/java/org/apache/commons/xml/HardeningXPath.java @@ -67,7 +67,7 @@ final class HardeningXPath implements XPath { static Document parse(final InputSource source, final boolean overrideDefaultParser) throws XPathExpressionException { Objects.requireNonNull(source, "source"); try { - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newNSInstance(overrideDefaultParser); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(overrideDefaultParser); return factory.newDocumentBuilder().parse(source); } catch (final ParserConfigurationException | SAXException | IOException e) { throw new XPathExpressionException(e); diff --git a/src/main/java/org/apache/commons/xml/HardeningDocumentBuilderFactory.java b/src/main/java/org/apache/commons/xml/SecureDocumentBuilderFactory.java similarity index 99% rename from src/main/java/org/apache/commons/xml/HardeningDocumentBuilderFactory.java rename to src/main/java/org/apache/commons/xml/SecureDocumentBuilderFactory.java index 2284d9f..fa8a1ef 100644 --- a/src/main/java/org/apache/commons/xml/HardeningDocumentBuilderFactory.java +++ b/src/main/java/org/apache/commons/xml/SecureDocumentBuilderFactory.java @@ -46,7 +46,7 @@ * * @see org.apache.commons.xml */ -public final class HardeningDocumentBuilderFactory { +public final class SecureDocumentBuilderFactory { /** Class name of Android's Harmony-based {@link DocumentBuilderFactory}, which exposes no hardening surface. */ private static final String ANDROID_DOCUMENT_BUILDER_FACTORY = "org.apache.harmony.xml.parsers.DocumentBuilderFactoryImpl"; @@ -236,7 +236,7 @@ private static void setFeature(final DocumentBuilderFactory factory, final Strin } } - private HardeningDocumentBuilderFactory() { + private SecureDocumentBuilderFactory() { // static only } diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md index bc57ec2..0ea9d70 100644 --- a/src/site/markdown/index.md +++ b/src/site/markdown/index.md @@ -87,7 +87,7 @@ requires a code change to this library. ```java import org.w3c.dom.Document; -import org.apache.commons.xml.HardeningDocumentBuilderFactory; +import org.apache.commons.xml.SecureDocumentBuilderFactory; Document doc = HardeningDocumentBuilderFactory.newInstance().newDocumentBuilder().parse(inputStream); ``` diff --git a/src/test/java/org/apache/commons/xml/AttackTestSupport.java b/src/test/java/org/apache/commons/xml/AttackTestSupport.java index 0edeae0..b0b95b4 100644 --- a/src/test/java/org/apache/commons/xml/AttackTestSupport.java +++ b/src/test/java/org/apache/commons/xml/AttackTestSupport.java @@ -207,10 +207,10 @@ public void warning(final TransformerException exception) { /** * Asserts a hardened DOM parse of the payload throws. * - * <p>{@link DocumentBuilder#parse(InputSource)} via {@link HardeningDocumentBuilderFactory#newInstance()}; only a thrown exception passes.</p> + * <p>{@link DocumentBuilder#parse(InputSource)} via {@link SecureDocumentBuilderFactory#newInstance()}; only a thrown exception passes.</p> */ static void assertDomBlocks(final String payload) { - assertParseFails(() -> strictDocumentBuilder(HardeningDocumentBuilderFactory.newInstance()).parse(inputSource(payload)), "DOM", SAXException.class); + assertParseFails(() -> strictDocumentBuilder(SecureDocumentBuilderFactory.newInstance()).parse(inputSource(payload)), "DOM", SAXException.class); } /** @@ -226,7 +226,7 @@ static void assertDomBlocksOrDoesNotLeak(final String payload) { /** * Asserts a hardened DOM parse completes without throwing and without leaked content. * - * <p>{@link DocumentBuilder#parse(InputSource)} via {@link HardeningDocumentBuilderFactory#newInstance()}; use this when the hardening guarantee is "the parse + * <p>{@link DocumentBuilder#parse(InputSource)} via {@link SecureDocumentBuilderFactory#newInstance()}; use this when the hardening guarantee is "the parse * succeeds but never resolves the external resource", for example, when the ignore-all resolver floor resolves the external subset to empty content.</p> */ static void assertDomDoesNotLeak(final String payload) { @@ -236,10 +236,10 @@ static void assertDomDoesNotLeak(final String payload) { /** * Asserts a hardened DOM parse succeeds. * - * <p>{@link DocumentBuilder#parse(InputSource)} via {@link HardeningDocumentBuilderFactory#newInstance()}; positive control for DOCTYPE-only payloads.</p> + * <p>{@link DocumentBuilder#parse(InputSource)} via {@link SecureDocumentBuilderFactory#newInstance()}; positive control for DOCTYPE-only payloads.</p> */ static void assertDomParses(final String payload) { - assertParseSucceeds(() -> strictDocumentBuilder(HardeningDocumentBuilderFactory.newInstance()).parse(inputSource(payload)), "DOM"); + assertParseSucceeds(() -> strictDocumentBuilder(SecureDocumentBuilderFactory.newInstance()).parse(inputSource(payload)), "DOM"); } /** @@ -834,7 +834,7 @@ private static void consumeXmlReader(final XMLReader reader, final String payloa } private static String domParseAndCaptureText(final String payload) throws Exception { - final Document doc = strictDocumentBuilder(HardeningDocumentBuilderFactory.newInstance()).parse(inputSource(payload)); + final Document doc = strictDocumentBuilder(SecureDocumentBuilderFactory.newInstance()).parse(inputSource(payload)); if (doc.getDocumentElement() == null) { return ""; } diff --git a/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java b/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java index 22a943a..57a4d7c 100644 --- a/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java +++ b/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java @@ -126,7 +126,7 @@ private static XMLInputFactory externalEntityStaxFactory() { } private static DocumentBuilder hardenedBuilder() throws Exception { - final DocumentBuilder builder = HardeningDocumentBuilderFactory.newInstance().newDocumentBuilder(); + final DocumentBuilder builder = SecureDocumentBuilderFactory.newInstance().newDocumentBuilder(); builder.setErrorHandler(AttackTestSupport.STRICT_REPORTER); return builder; } @@ -168,7 +168,7 @@ private static LSInput lsInput(final String systemId) { } private static DocumentBuilder xIncludeAwareBuilder() throws Exception { - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); AttackTestSupport.assumeDoesNotThrow(() -> factory.setXIncludeAware(true)); final DocumentBuilder builder = factory.newDocumentBuilder(); diff --git a/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java b/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java index 0b4372f..a671627 100644 --- a/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java +++ b/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java @@ -58,7 +58,7 @@ class HardeningFactoriesSmokeTest { */ @Test void publicClassesDoNotExtendTheirJaxpFactoryType() { - assertFalse(DocumentBuilderFactory.class.isAssignableFrom(HardeningDocumentBuilderFactory.class)); + assertFalse(DocumentBuilderFactory.class.isAssignableFrom(SecureDocumentBuilderFactory.class)); assertFalse(SAXParserFactory.class.isAssignableFrom(HardeningSAXParserFactory.class)); assertFalse(SchemaFactory.class.isAssignableFrom(HardeningSchemaFactory.class)); assertFalse(TransformerFactory.class.isAssignableFrom(HardeningTransformerFactory.class)); @@ -68,28 +68,28 @@ void publicClassesDoNotExtendTheirJaxpFactoryType() { @Test void benignDocumentParses() throws Exception { - final Document doc = HardeningDocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new InputSource(new StringReader(BENIGN_XML))); + final Document doc = SecureDocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new InputSource(new StringReader(BENIGN_XML))); assertNotNull(doc); assertNotNull(doc.getDocumentElement()); } @Test void newDocumentBuilderFactoryDisablesXIncludeAndValidation() { - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); assertFalse(factory.isXIncludeAware(), "XInclude must be off by default"); assertFalse(factory.isValidating(), "Validation must be off by default"); } @Test void newDocumentBuilderFactoryEnablesSecureProcessing() throws Exception { - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING), "FEATURE_SECURE_PROCESSING must be on"); } @Test void newDocumentBuilderFactoryReturnsFreshInstance() { - final DocumentBuilderFactory a = HardeningDocumentBuilderFactory.newInstance(); - final DocumentBuilderFactory b = HardeningDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory a = SecureDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory b = SecureDocumentBuilderFactory.newInstance(); assertNotNull(a); assertNotNull(b); assertNotSame(a, b); @@ -141,7 +141,7 @@ void newXPathFactoryReturnsFreshInstance() throws Exception { @Test void explicitClassNameDocumentBuilderFactoryIsHardened() throws Exception { final Class<?> impl = DocumentBuilderFactory.newInstance().getClass(); - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newInstance(impl.getName(), impl.getClassLoader()); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(impl.getName(), impl.getClassLoader()); assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)); } @@ -196,7 +196,7 @@ void factoryIdXMLInputFactoryIsHardened() { @Test void unknownFactoryClassNameThrows() { - assertThrows(FactoryConfigurationError.class, () -> HardeningDocumentBuilderFactory.newInstance("no.such.FactoryClass", null)); + assertThrows(FactoryConfigurationError.class, () -> SecureDocumentBuilderFactory.newInstance("no.such.FactoryClass", null)); } // The newDefault* methods resolve the Java 9 JAXP method at runtime and fall back to the JDK's built-in implementation on Java 8. The dom and sax @@ -206,10 +206,10 @@ void unknownFactoryClassNameThrows() { @Tag("dom") void newDefaultInstanceDocumentBuilderFactoryIsUsable() throws Exception { if (AttackTestSupport.IS_ANDROID) { - assertThrows(FactoryConfigurationError.class, HardeningDocumentBuilderFactory::newDefaultInstance); + assertThrows(FactoryConfigurationError.class, SecureDocumentBuilderFactory::newDefaultInstance); return; } - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newDefaultInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newDefaultInstance(); assertNotNull(factory.newDocumentBuilder().parse(new InputSource(new StringReader(BENIGN_XML))).getDocumentElement()); assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)); } @@ -231,7 +231,7 @@ void newDefaultInstanceSAXParserFactoryIsUsable() throws Exception { @Test @Tag("dom") void newNSInstanceDocumentBuilderFactoryIsNamespaceAware() throws Exception { - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newNSInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(); assertTrue(factory.isNamespaceAware()); assertNotNull(factory.newDocumentBuilder().parse(new InputSource(new StringReader(BENIGN_XML))).getDocumentElement()); if (!AttackTestSupport.IS_ANDROID) { @@ -243,10 +243,10 @@ void newNSInstanceDocumentBuilderFactoryIsNamespaceAware() throws Exception { @Tag("dom") void newDefaultNSInstanceDocumentBuilderFactoryIsNamespaceAware() throws Exception { if (AttackTestSupport.IS_ANDROID) { - assertThrows(FactoryConfigurationError.class, HardeningDocumentBuilderFactory::newDefaultNSInstance); + assertThrows(FactoryConfigurationError.class, SecureDocumentBuilderFactory::newDefaultNSInstance); return; } - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newDefaultNSInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newDefaultNSInstance(); assertTrue(factory.isNamespaceAware()); assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)); } @@ -277,7 +277,7 @@ void newDefaultNSInstanceSAXParserFactoryIsNamespaceAware() throws Exception { @Test void explicitClassNameNSDocumentBuilderFactoryIsNamespaceAware() throws Exception { final Class<?> impl = DocumentBuilderFactory.newInstance().getClass(); - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newNSInstance(impl.getName(), impl.getClassLoader()); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(impl.getName(), impl.getClassLoader()); assertTrue(factory.isNamespaceAware()); assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)); } diff --git a/src/test/java/org/apache/commons/xml/ResetHardeningTest.java b/src/test/java/org/apache/commons/xml/ResetHardeningTest.java index 6c8cd03..b2b2c94 100644 --- a/src/test/java/org/apache/commons/xml/ResetHardeningTest.java +++ b/src/test/java/org/apache/commons/xml/ResetHardeningTest.java @@ -59,7 +59,7 @@ private static String entityPayload(final String entitySystemId) { @Tag("dom") void documentBuilderResetKeepsEntityResolverFloor() throws Exception { Assumptions.assumeTrue(AttackTestSupport.DOM_RESOLVES_INTERNAL_ENTITIES, "platform DOM does not resolve user-defined entities"); - final DocumentBuilder builder = HardeningDocumentBuilderFactory.newInstance().newDocumentBuilder(); + final DocumentBuilder builder = SecureDocumentBuilderFactory.newInstance().newDocumentBuilder(); AttackTestSupport.assumeDoesNotThrow(builder::reset); try { final Document doc = builder.parse(AttackTestSupport.inputSource(entityPayload(UNLISTED))); diff --git a/src/test/java/org/apache/commons/xml/SchemaLocationDomTest.java b/src/test/java/org/apache/commons/xml/SchemaLocationDomTest.java index d4700b6..904f72a 100644 --- a/src/test/java/org/apache/commons/xml/SchemaLocationDomTest.java +++ b/src/test/java/org/apache/commons/xml/SchemaLocationDomTest.java @@ -87,7 +87,7 @@ private static boolean supportsSchemaLanguage() { @Test void hardenedDoesNotFetchExternalSchema() { assumeTrue(supportsSchemaLanguage(), "parser does not support JAXP 1.2 schema-language XSD validation"); - final DocumentBuilderFactory factory = enableXsdValidation(HardeningDocumentBuilderFactory.newInstance()); + final DocumentBuilderFactory factory = enableXsdValidation(SecureDocumentBuilderFactory.newInstance()); // The schemaLocation reference resolves to empty rather than being fetched. Either the empty schema fails the validating parse (acceptable), or the // parse completes but the schema's default leak attribute is never inlined. Either way the marker must not reach the DOM. try { diff --git a/src/test/java/org/apache/commons/xml/SchemaLocationPropertyTest.java b/src/test/java/org/apache/commons/xml/SchemaLocationPropertyTest.java index 15c9640..1b0e909 100644 --- a/src/test/java/org/apache/commons/xml/SchemaLocationPropertyTest.java +++ b/src/test/java/org/apache/commons/xml/SchemaLocationPropertyTest.java @@ -82,7 +82,7 @@ private static <T> T configureOrSkip(final ThrowingSupplier<T> setup) { private static DocumentBuilder hardenedValidatingDom(final String property, final String value) { return configureOrSkip(() -> { - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); factory.setValidating(true); factory.setAttribute(SCHEMA_LANGUAGE, XMLConstants.W3C_XML_SCHEMA_NS_URI); diff --git a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java index 407be28..eb90418 100644 --- a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java +++ b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java @@ -59,9 +59,9 @@ class ShadingFootprintTest { private static final Set<String> DOCUMENT_BUILDER_FACTORY = set( "FallbackIgnoreEntityResolver2", "SecureDocumentBuilder", - "HardeningDocumentBuilderFactory", - "HardeningDocumentBuilderFactory$1", - "HardeningDocumentBuilderFactory$Wrapper", + "SecureDocumentBuilderFactory", + "SecureDocumentBuilderFactory$1", + "SecureDocumentBuilderFactory$Wrapper", "HardeningException", "MethodHandleFactory"); // @formatter:on @@ -99,9 +99,9 @@ class ShadingFootprintTest { "FallbackIgnoreEntityResolver2", "FallbackIgnoreURIResolver", "SecureDocumentBuilder", - "HardeningDocumentBuilderFactory", - "HardeningDocumentBuilderFactory$1", - "HardeningDocumentBuilderFactory$Wrapper", + "SecureDocumentBuilderFactory", + "SecureDocumentBuilderFactory$1", + "SecureDocumentBuilderFactory$Wrapper", "HardeningException", "HardeningSAXParser", "HardeningSAXParserFactory", @@ -128,9 +128,9 @@ class ShadingFootprintTest { "FallbackIgnoreEntityResolver2", "FallbackIgnoreURIResolver", "SecureDocumentBuilder", - "HardeningDocumentBuilderFactory", - "HardeningDocumentBuilderFactory$1", - "HardeningDocumentBuilderFactory$Wrapper", + "SecureDocumentBuilderFactory", + "SecureDocumentBuilderFactory$1", + "SecureDocumentBuilderFactory$Wrapper", "MethodHandleFactory", "HardeningException", "HardeningSAXParser", @@ -177,7 +177,7 @@ class ShadingFootprintTest { /** * Entry points reported by the {@link #reportFootprint()} diagnostic, most-focused first, ending with the whole library. */ - private static final String[] REPORTED = {"HardeningDocumentBuilderFactory", "HardeningSAXParserFactory", "HardeningXMLInputFactory", + private static final String[] REPORTED = {"SecureDocumentBuilderFactory", "HardeningSAXParserFactory", "HardeningXMLInputFactory", "HardeningTransformerFactory", "HardeningXPathFactory", "HardeningSchemaFactory"}; private static Clazzpath clazzpath; @@ -242,7 +242,7 @@ static void reportFootprint() { } private static Set<String> rootClosure() { - return closureOf("HardeningDocumentBuilderFactory"); + return closureOf("SecureDocumentBuilderFactory"); } /** @@ -264,12 +264,12 @@ private static String strip(final String qualifiedName) { @Test void documentBuilderFactoryFootprint() { - assertEquals(DOCUMENT_BUILDER_FACTORY, closureOf("HardeningDocumentBuilderFactory")); + assertEquals(DOCUMENT_BUILDER_FACTORY, closureOf("SecureDocumentBuilderFactory")); } @Test void rootClosureMatchesDocumentBuilderFootprint() { - assertEquals(LIBRARY_CLASS_COUNT, rootClosure().size(), "HardeningDocumentBuilderFactory closure size drifted"); + assertEquals(LIBRARY_CLASS_COUNT, rootClosure().size(), "SecureDocumentBuilderFactory closure size drifted"); } @Test diff --git a/src/test/java/org/apache/commons/xml/UnsupportedXmlImplementationTest.java b/src/test/java/org/apache/commons/xml/UnsupportedXmlImplementationTest.java index 23fcfdd..3e4fc5b 100644 --- a/src/test/java/org/apache/commons/xml/UnsupportedXmlImplementationTest.java +++ b/src/test/java/org/apache/commons/xml/UnsupportedXmlImplementationTest.java @@ -93,7 +93,7 @@ public void setFeature(final String name, final boolean value) throws SAXNotReco void hardenRejectsUnsecurableFactory() { final IllegalStateException thrown = assertThrows( IllegalStateException.class, - () -> HardeningDocumentBuilderFactory.harden(new FakeDocumentBuilderFactory())); + () -> SecureDocumentBuilderFactory.harden(new FakeDocumentBuilderFactory())); assertNotNull(thrown.getMessage()); assertTrue(thrown.getMessage().contains(FakeDocumentBuilderFactory.class.getName()), "Exception message must name the unsupported class: " + thrown.getMessage()); diff --git a/src/test/java/org/apache/commons/xml/XIncludeTest.java b/src/test/java/org/apache/commons/xml/XIncludeTest.java index 64cda94..7a952d2 100644 --- a/src/test/java/org/apache/commons/xml/XIncludeTest.java +++ b/src/test/java/org/apache/commons/xml/XIncludeTest.java @@ -187,7 +187,7 @@ void baselineSaxLeaksParseXml() throws Exception { void hardenedDomBlocksParseText() throws Exception { final InputSource input = inputSource(xiIncludeXml(REFERENCED_TEXT, "text")); - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); assumeXIncludeAware(factory); final Document doc = factory.newDocumentBuilder().parse(input); @@ -201,7 +201,7 @@ void hardenedDomBlocksParseText() throws Exception { void hardenedDomBlocksParseXml() throws Exception { final InputSource input = inputSource(xiIncludeXml(REFERENCED_XML, "xml")); - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); assumeXIncludeAware(factory); assertThrows(SAXException.class, () -> { @@ -215,7 +215,7 @@ void hardenedDomBlocksParseXml() throws Exception { void hardenedDomNullResolverDoesNotLeak() throws Exception { final InputSource input = inputSource(xiIncludeXml(REFERENCED_XML, "xml")); - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); assumeXIncludeAware(factory); final DocumentBuilder builder = factory.newDocumentBuilder(); @@ -229,7 +229,7 @@ void hardenedDomNullResolverDoesNotLeak() throws Exception { void hardenedDomWithAllowListResolvesParseText() throws Exception { final InputSource input = inputSource(xiIncludeXml(REFERENCED_TEXT, "text")); - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); assumeXIncludeAware(factory); final DocumentBuilder builder = factory.newDocumentBuilder(); @@ -248,7 +248,7 @@ void hardenedDomWithAllowListResolvesParseText() throws Exception { void hardenedDomWithAllowListResolvesParseXml() throws Exception { final InputSource input = inputSource(xiIncludeXml(REFERENCED_XML, "xml")); - final DocumentBuilderFactory factory = HardeningDocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); assumeXIncludeAware(factory); final DocumentBuilder builder = factory.newDocumentBuilder();
