This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 01262a54e62c827f747c51719f34d3ba429346af Author: Gary Gregory <[email protected]> AuthorDate: Fri Aug 28 13:26:09 2026 -0400 Rename HardeningXPathFactory to SecureXPathFactory. Local build OK. --- .../{HardeningXPathFactory.java => SecureXPathFactory.java} | 4 ++-- src/site/markdown/index.md | 2 +- .../org/apache/commons/xml/HardeningFactoriesSmokeTest.java | 10 +++++----- .../java/org/apache/commons/xml/OverrideDefaultParserTest.java | 2 +- src/test/java/org/apache/commons/xml/ShadingFootprintTest.java | 10 +++++----- src/test/java/org/apache/commons/xml/XPathInputSourceTest.java | 8 ++++---- 6 files changed, 18 insertions(+), 18 deletions(-) diff --git a/src/main/java/org/apache/commons/xml/HardeningXPathFactory.java b/src/main/java/org/apache/commons/xml/SecureXPathFactory.java similarity index 99% rename from src/main/java/org/apache/commons/xml/HardeningXPathFactory.java rename to src/main/java/org/apache/commons/xml/SecureXPathFactory.java index 03416a1..52f431b 100644 --- a/src/main/java/org/apache/commons/xml/HardeningXPathFactory.java +++ b/src/main/java/org/apache/commons/xml/SecureXPathFactory.java @@ -45,7 +45,7 @@ * * @see org.apache.commons.xml */ -public final class HardeningXPathFactory { +public final class SecureXPathFactory { /** Class name of the JDK's built-in default implementation, the Java 8 fallback for {@link #newDefaultInstance()}. */ private static final String JDK_XPATH_FACTORY = "com.sun.org.apache.xpath.internal.jaxp.XPathFactoryImpl"; @@ -182,7 +182,7 @@ private static void setFeature(final XPathFactory factory, final String feature, } } - private HardeningXPathFactory() { + private SecureXPathFactory() { // static only } diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md index 594b149..d898710 100644 --- a/src/site/markdown/index.md +++ b/src/site/markdown/index.md @@ -126,7 +126,7 @@ HardeningTransformerFactory.newInstance() ```java import javax.xml.xpath.XPathConstants; import org.w3c.dom.NodeList; -import org.apache.commons.xml.HardeningXPathFactory; +import org.apache.commons.xml.SecureXPathFactory; NodeList hits = (NodeList) HardeningXPathFactory.newInstance() .newXPath() diff --git a/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java b/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java index 0b75b59..ca7a800 100644 --- a/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java +++ b/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java @@ -63,7 +63,7 @@ void publicClassesDoNotExtendTheirJaxpFactoryType() { assertFalse(SchemaFactory.class.isAssignableFrom(SecureSchemaFactory.class)); assertFalse(TransformerFactory.class.isAssignableFrom(SecureTransformerFactory.class)); assertFalse(XMLInputFactory.class.isAssignableFrom(SecureXMLInputFactory.class)); - assertFalse(XPathFactory.class.isAssignableFrom(HardeningXPathFactory.class)); + assertFalse(XPathFactory.class.isAssignableFrom(SecureXPathFactory.class)); } @Test @@ -130,8 +130,8 @@ void newXMLInputFactoryReturnsFreshInstance() { @Test void newXPathFactoryReturnsFreshInstance() throws Exception { - final XPathFactory a = HardeningXPathFactory.newInstance(); - final XPathFactory b = HardeningXPathFactory.newInstance(); + final XPathFactory a = SecureXPathFactory.newInstance(); + final XPathFactory b = SecureXPathFactory.newInstance(); assertNotSame(a, b); assertTrue(a.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)); } @@ -169,7 +169,7 @@ void explicitClassNameTransformerFactoryIsHardened() { @Test void explicitClassNameXPathFactoryIsHardened() throws Exception { final Class<?> impl = XPathFactory.newInstance().getClass(); - final XPathFactory factory = HardeningXPathFactory.newInstance(XPathFactory.DEFAULT_OBJECT_MODEL_URI, impl.getName(), impl.getClassLoader()); + final XPathFactory factory = SecureXPathFactory.newInstance(XPathFactory.DEFAULT_OBJECT_MODEL_URI, impl.getName(), impl.getClassLoader()); assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)); } @@ -310,7 +310,7 @@ void newDefaultFactoryXMLInputFactoryIsHardened() { @Test void newDefaultInstanceXPathFactoryIsHardened() throws Exception { - final XPathFactory factory = HardeningXPathFactory.newDefaultInstance(); + final XPathFactory factory = SecureXPathFactory.newDefaultInstance(); assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)); } } diff --git a/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java b/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java index 39a1a02..030cc1a 100644 --- a/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java +++ b/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java @@ -121,7 +121,7 @@ private static boolean xercesOnClasspath() { @Test void xPathFactoryReadsFeatureAtCreation() throws Exception { assumeFalse(AttackTestSupport.IS_ANDROID); - final XPathFactory factory = HardeningXPathFactory.newDefaultInstance(); + final XPathFactory factory = SecureXPathFactory.newDefaultInstance(); assertFalse(factory.getFeature(FEATURE)); assertFalse(((SecureXPath) factory.newXPath()).overrideDefaultParser); factory.setFeature(FEATURE, true); diff --git a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java index d45d533..5e01c37 100644 --- a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java +++ b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java @@ -141,9 +141,9 @@ class ShadingFootprintTest { "SecureXMLReader", "SecureXPath", "SecureXPathExpression", - "HardeningXPathFactory", - "HardeningXPathFactory$1", - "HardeningXPathFactory$Wrapper", + "SecureXPathFactory", + "SecureXPathFactory$1", + "SecureXPathFactory$Wrapper", "SaxonProvider", "SaxonProvider$1", "SaxonProvider$HardenedConfiguration", @@ -178,7 +178,7 @@ class ShadingFootprintTest { * Entry points reported by the {@link #reportFootprint()} diagnostic, most-focused first, ending with the whole library. */ private static final String[] REPORTED = {"SecureDocumentBuilderFactory", "SecureSAXParserFactory", "SecureXMLInputFactory", - "SecureTransformerFactory", "HardeningXPathFactory", "SecureSchemaFactory"}; + "SecureTransformerFactory", "SecureXPathFactory", "SecureSchemaFactory"}; private static Clazzpath clazzpath; private static Path classesDir; @@ -294,6 +294,6 @@ void transformerFactoryFootprint() { @Test void xPathFactoryFootprint() { - assertEquals(XPATH_FACTORY, closureOf("HardeningXPathFactory")); + assertEquals(XPATH_FACTORY, closureOf("SecureXPathFactory")); } } diff --git a/src/test/java/org/apache/commons/xml/XPathInputSourceTest.java b/src/test/java/org/apache/commons/xml/XPathInputSourceTest.java index 198ad48..137c1ad 100644 --- a/src/test/java/org/apache/commons/xml/XPathInputSourceTest.java +++ b/src/test/java/org/apache/commons/xml/XPathInputSourceTest.java @@ -31,7 +31,7 @@ * external general entity. * * <p>The stock JDK and Apache Xalan implement the {@link org.xml.sax.InputSource}-taking {@code evaluate} entry points by provisioning an internal document - * parser that {@code FEATURE_SECURE_PROCESSING} on the {@link XPathFactory} does not reach. The {@link HardeningXPathFactory} wrapper parses the input + * parser that {@code FEATURE_SECURE_PROCESSING} on the {@link XPathFactory} does not reach. The {@link SecureXPathFactory} wrapper parses the input * through a hardened {@code DocumentBuilder} instead, so the external reference resolves to empty on the floor, while the * evaluation itself still works. Tagged {@code xpath}, so it runs under test-stockjdk, test-jdk-xerces, test-xalan and test-xalan-xerces; the Saxon engine takes the separate * {@code SaxonProvider} path covered by {@code SaxonXPathExternalCallsTest}.</p> @@ -52,14 +52,14 @@ private static String entityPayload() { void hardenedXPathEvaluateDoesNotLeak() throws Exception { // Deterministic on every engine: the entity is declared in the internal subset and the floor resolves only its // external content — to empty replacement text — so the pre-parse completes and the reference expands to nothing. - final String result = HardeningXPathFactory.newInstance().newXPath().evaluate(EXPRESSION, AttackTestSupport.inputSource(entityPayload())); + final String result = SecureXPathFactory.newInstance().newXPath().evaluate(EXPRESSION, AttackTestSupport.inputSource(entityPayload())); assertFalse(result.contains(AttackTestSupport.LEAKED_MARKER), "external entity leaked into the XPath result: " + result); } @Test void hardenedXPathEvaluatesPlainDocument() throws Exception { // Positive control: the hardened pre-parse still evaluates an entity-free document end to end. - final String result = HardeningXPathFactory.newInstance().newXPath().evaluate(EXPRESSION, + final String result = SecureXPathFactory.newInstance().newXPath().evaluate(EXPRESSION, AttackTestSupport.inputSource(AttackTestSupport.xmlBody("plain text"))); assertEquals("plain text", result, "hardened XPath should evaluate a plain document"); } @@ -67,7 +67,7 @@ void hardenedXPathEvaluatesPlainDocument() throws Exception { @Test void hardenedXPathExpressionEvaluateDoesNotLeak() throws Exception { // Same declared-entity outcome as above on the compiled-expression entry point. - final String result = HardeningXPathFactory.newInstance().newXPath().compile(EXPRESSION).evaluate(AttackTestSupport.inputSource(entityPayload())); + final String result = SecureXPathFactory.newInstance().newXPath().compile(EXPRESSION).evaluate(AttackTestSupport.inputSource(entityPayload())); assertFalse(result.contains(AttackTestSupport.LEAKED_MARKER), "external entity leaked into the compiled XPath result: " + result); }
