This is an automated email from the ASF dual-hosted git repository. ppkarwasz pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 58c030097c8fe4c90b29e1d2559eaebd4adeabd9 Author: Piotr P. Karwasz <[email protected]> AuthorDate: Sun Aug 30 20:24:30 2026 +0200 Tag the Secure* wrapper tests by JAXP factory group Tag each Secure* factory and product-wrapper test class with the group of the JAXP factory it concerns (dom, sax, stax, trax, xpath, schema), so the tests run across the whole implementation matrix instead of only the stock-JDK execution. Adapt the four assertions the wider matrix exposed as stock-JDK-specific: the configuration-forwarding probes now use keys every matrix implementation recognizes (the JAXP 1.2 schemaLanguage attribute and the Xerces external-schemaLocation and locale properties, supported by the JDK-internal and standalone Xerces alike) instead of the JAXP 1.5 external-access keys, the XSLTC-only indent-number attribute tolerates the delegate's rejection as the forwarding proof, and the XMLFilter parent-failure test asserts the portable contract, since XSLTC, Xalan and Saxon each surface the failure in a different shape. Assisted-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MbfpcsKig16HfSe6jGhcvh --- .../apache/commons/xml/SecureDocumentBuilderFactoryTest.java | 7 +++++-- .../org/apache/commons/xml/SecureDocumentBuilderTest.java | 2 ++ .../org/apache/commons/xml/SecureSAXParserFactoryTest.java | 2 ++ .../java/org/apache/commons/xml/SecureSAXParserTest.java | 2 ++ .../java/org/apache/commons/xml/SecureSchemaFactoryTest.java | 5 ++++- src/test/java/org/apache/commons/xml/SecureSchemaTest.java | 2 ++ .../org/apache/commons/xml/SecureTemplatesHandlerTest.java | 2 ++ .../java/org/apache/commons/xml/SecureTemplatesTest.java | 2 ++ .../org/apache/commons/xml/SecureTransformerFactoryTest.java | 12 ++++++++---- .../org/apache/commons/xml/SecureTransformerHandlerTest.java | 2 ++ .../java/org/apache/commons/xml/SecureTransformerTest.java | 2 ++ .../org/apache/commons/xml/SecureValidatorHandlerTest.java | 2 ++ .../java/org/apache/commons/xml/SecureValidatorTest.java | 6 +++++- .../java/org/apache/commons/xml/SecureXMLFilterTest.java | 12 +++++++++--- .../java/org/apache/commons/xml/SecureXMLReaderTest.java | 2 ++ .../org/apache/commons/xml/SecureXPathExpressionTest.java | 2 ++ .../java/org/apache/commons/xml/SecureXPathFactoryTest.java | 2 ++ src/test/java/org/apache/commons/xml/SecureXPathTest.java | 2 ++ src/test/java/org/apache/commons/xml/TestConstants.java | 9 +++++++++ 19 files changed, 66 insertions(+), 11 deletions(-) diff --git a/src/test/java/org/apache/commons/xml/SecureDocumentBuilderFactoryTest.java b/src/test/java/org/apache/commons/xml/SecureDocumentBuilderFactoryTest.java index 39532fd..4d51d9d 100644 --- a/src/test/java/org/apache/commons/xml/SecureDocumentBuilderFactoryTest.java +++ b/src/test/java/org/apache/commons/xml/SecureDocumentBuilderFactoryTest.java @@ -17,6 +17,7 @@ package org.apache.commons.xml; +import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertInstanceOf; import static org.junit.jupiter.api.Assertions.assertNotNull; @@ -26,8 +27,10 @@ import javax.xml.XMLConstants; import javax.xml.parsers.DocumentBuilderFactory; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; +@Tag("dom") class SecureDocumentBuilderFactoryTest { @Test @@ -50,7 +53,8 @@ void forwardsEverySupportedFactoryConfiguration() throws Exception { factory.setXIncludeAware(false); factory.setSchema(null); factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - factory.setAttribute(TestConstants.ACCESS_EXTERNAL_DTD, ""); + factory.setAttribute(TestConstants.JAXP_SCHEMA_LANGUAGE, XMLConstants.W3C_XML_SCHEMA_NS_URI); + assertEquals(XMLConstants.W3C_XML_SCHEMA_NS_URI, factory.getAttribute(TestConstants.JAXP_SCHEMA_LANGUAGE)); assertTrue(factory.isCoalescing()); assertFalse(factory.isExpandEntityReferences()); assertTrue(factory.isIgnoringComments()); @@ -60,7 +64,6 @@ void forwardsEverySupportedFactoryConfiguration() throws Exception { assertFalse(factory.isXIncludeAware()); assertNull(factory.getSchema()); assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)); - assertNotNull(factory.getAttribute(TestConstants.ACCESS_EXTERNAL_DTD)); assertNotNull(factory.newDocumentBuilder()); } diff --git a/src/test/java/org/apache/commons/xml/SecureDocumentBuilderTest.java b/src/test/java/org/apache/commons/xml/SecureDocumentBuilderTest.java index 7f8ad71..7f654ec 100644 --- a/src/test/java/org/apache/commons/xml/SecureDocumentBuilderTest.java +++ b/src/test/java/org/apache/commons/xml/SecureDocumentBuilderTest.java @@ -24,8 +24,10 @@ import javax.xml.parsers.DocumentBuilderFactory; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; +@Tag("dom") class SecureDocumentBuilderTest { @Test diff --git a/src/test/java/org/apache/commons/xml/SecureSAXParserFactoryTest.java b/src/test/java/org/apache/commons/xml/SecureSAXParserFactoryTest.java index e5ee56b..cb840d5 100644 --- a/src/test/java/org/apache/commons/xml/SecureSAXParserFactoryTest.java +++ b/src/test/java/org/apache/commons/xml/SecureSAXParserFactoryTest.java @@ -33,10 +33,12 @@ import javax.xml.transform.sax.SAXSource; import javax.xml.transform.stream.StreamSource; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.xml.sax.InputSource; import org.xml.sax.XMLReader; +@Tag("sax") class SecureSAXParserFactoryTest { @Test diff --git a/src/test/java/org/apache/commons/xml/SecureSAXParserTest.java b/src/test/java/org/apache/commons/xml/SecureSAXParserTest.java index 2b9e71a..1f27c18 100644 --- a/src/test/java/org/apache/commons/xml/SecureSAXParserTest.java +++ b/src/test/java/org/apache/commons/xml/SecureSAXParserTest.java @@ -28,6 +28,7 @@ import javax.xml.parsers.SAXParserFactory; import javax.xml.validation.Schema; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.xml.sax.DocumentHandler; import org.xml.sax.Parser; @@ -35,6 +36,7 @@ import org.xml.sax.SAXNotSupportedException; import org.xml.sax.XMLReader; +@Tag("sax") class SecureSAXParserTest { private static final class ParserSecureReader extends SecureXMLReader implements Parser { diff --git a/src/test/java/org/apache/commons/xml/SecureSchemaFactoryTest.java b/src/test/java/org/apache/commons/xml/SecureSchemaFactoryTest.java index 7af8921..684c694 100644 --- a/src/test/java/org/apache/commons/xml/SecureSchemaFactoryTest.java +++ b/src/test/java/org/apache/commons/xml/SecureSchemaFactoryTest.java @@ -28,6 +28,7 @@ import javax.xml.validation.Schema; import javax.xml.validation.SchemaFactory; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.w3c.dom.ls.LSResourceResolver; import org.xml.sax.ErrorHandler; @@ -36,6 +37,7 @@ import org.xml.sax.SAXNotSupportedException; import org.xml.sax.helpers.DefaultHandler; +@Tag("schema") class SecureSchemaFactoryTest { private static final class PropertySchemaFactory extends SchemaFactory { @@ -111,7 +113,8 @@ void forwardsSchemaFactoryConfigurationAndAccessors() throws Exception { factory.setErrorHandler(errorHandler); factory.setResourceResolver(resolver); factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - factory.setProperty(TestConstants.ACCESS_EXTERNAL_SCHEMA, ""); + factory.setProperty(TestConstants.EXTERNAL_SCHEMA_LOCATION, "urn:example schema.xsd"); + assertEquals("urn:example schema.xsd", factory.getProperty(TestConstants.EXTERNAL_SCHEMA_LOCATION)); assertSame(errorHandler, factory.getErrorHandler()); assertSame(resolver, factory.getResourceResolver()); assertTrue(factory.isSchemaLanguageSupported(XMLConstants.W3C_XML_SCHEMA_NS_URI)); diff --git a/src/test/java/org/apache/commons/xml/SecureSchemaTest.java b/src/test/java/org/apache/commons/xml/SecureSchemaTest.java index e63c6f2..c3757f7 100644 --- a/src/test/java/org/apache/commons/xml/SecureSchemaTest.java +++ b/src/test/java/org/apache/commons/xml/SecureSchemaTest.java @@ -22,8 +22,10 @@ import javax.xml.XMLConstants; import javax.xml.validation.SchemaFactory; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; +@Tag("schema") class SecureSchemaTest { @Test diff --git a/src/test/java/org/apache/commons/xml/SecureTemplatesHandlerTest.java b/src/test/java/org/apache/commons/xml/SecureTemplatesHandlerTest.java index 9497eb3..bfcf4a6 100644 --- a/src/test/java/org/apache/commons/xml/SecureTemplatesHandlerTest.java +++ b/src/test/java/org/apache/commons/xml/SecureTemplatesHandlerTest.java @@ -31,11 +31,13 @@ import javax.xml.transform.sax.TemplatesHandler; import javax.xml.transform.stream.StreamSource; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.xml.sax.Attributes; import org.xml.sax.Locator; import org.xml.sax.helpers.DefaultHandler; +@Tag("trax") class SecureTemplatesHandlerTest { private static final class RecordingHandler extends DefaultHandler implements TemplatesHandler { diff --git a/src/test/java/org/apache/commons/xml/SecureTemplatesTest.java b/src/test/java/org/apache/commons/xml/SecureTemplatesTest.java index 2879c51..71e617f 100644 --- a/src/test/java/org/apache/commons/xml/SecureTemplatesTest.java +++ b/src/test/java/org/apache/commons/xml/SecureTemplatesTest.java @@ -29,8 +29,10 @@ import javax.xml.transform.TransformerFactory; import javax.xml.transform.stream.StreamSource; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; +@Tag("trax") class SecureTemplatesTest { @Test diff --git a/src/test/java/org/apache/commons/xml/SecureTransformerFactoryTest.java b/src/test/java/org/apache/commons/xml/SecureTransformerFactoryTest.java index 5ce46fa..83a2343 100644 --- a/src/test/java/org/apache/commons/xml/SecureTransformerFactoryTest.java +++ b/src/test/java/org/apache/commons/xml/SecureTransformerFactoryTest.java @@ -50,6 +50,7 @@ import org.xml.sax.InputSource; import org.xml.sax.XMLFilter; +@Tag("trax") class SecureTransformerFactoryTest { private static class NullProductsFactory extends SAXTransformerFactory { @@ -194,8 +195,6 @@ void rejectsDelegatesThatCannotEnableSecureProcessing() { } @Test - @Tag("trax") - @Tag("sax") void securesAssociatedStylesheetSourcesOfEverySupportedShape() throws Exception { final SAXTransformerFactory factory = (SAXTransformerFactory) SecureTransformerFactory.newInstance(); associatedStylesheet(factory, new StreamSource(new StringReader("<root/>"))); @@ -215,8 +214,13 @@ void wrapsEveryStandardAndSaxFactoryProduct() throws Exception { factory.setURIResolver(resolver); assertSame(resolver, factory.getURIResolver()); factory.setErrorListener(factory.getErrorListener()); - factory.setAttribute("indent-number", 2); - assertThrows(IllegalArgumentException.class, () -> factory.getAttribute("indent-number")); + try { + factory.setAttribute("indent-number", 2); + // XSLTC quirk: the attribute is settable but not readable. + assertThrows(IllegalArgumentException.class, () -> factory.getAttribute("indent-number")); + } catch (final IllegalArgumentException e) { + // Saxon and Xalan reject the XSLTC-only attribute at set time; the delegate's rejection is itself the forwarding proof. + } final Templates templates = factory.newTemplates(stylesheet()); assertInstanceOf(SecureTemplates.class, templates); assertInstanceOf(SecureTransformer.class, factory.newTransformer()); diff --git a/src/test/java/org/apache/commons/xml/SecureTransformerHandlerTest.java b/src/test/java/org/apache/commons/xml/SecureTransformerHandlerTest.java index 3e872dc..59348c4 100644 --- a/src/test/java/org/apache/commons/xml/SecureTransformerHandlerTest.java +++ b/src/test/java/org/apache/commons/xml/SecureTransformerHandlerTest.java @@ -26,10 +26,12 @@ import javax.xml.transform.sax.SAXTransformerFactory; import javax.xml.transform.stream.StreamResult; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.xml.sax.helpers.AttributesImpl; import org.xml.sax.helpers.LocatorImpl; +@Tag("trax") class SecureTransformerHandlerTest { @Test diff --git a/src/test/java/org/apache/commons/xml/SecureTransformerTest.java b/src/test/java/org/apache/commons/xml/SecureTransformerTest.java index 3393e6e..55f34c2 100644 --- a/src/test/java/org/apache/commons/xml/SecureTransformerTest.java +++ b/src/test/java/org/apache/commons/xml/SecureTransformerTest.java @@ -32,8 +32,10 @@ import javax.xml.transform.stream.StreamResult; import javax.xml.transform.stream.StreamSource; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; +@Tag("trax") class SecureTransformerTest { @Test diff --git a/src/test/java/org/apache/commons/xml/SecureValidatorHandlerTest.java b/src/test/java/org/apache/commons/xml/SecureValidatorHandlerTest.java index e61e07a..9336948 100644 --- a/src/test/java/org/apache/commons/xml/SecureValidatorHandlerTest.java +++ b/src/test/java/org/apache/commons/xml/SecureValidatorHandlerTest.java @@ -29,6 +29,7 @@ import javax.xml.validation.TypeInfoProvider; import javax.xml.validation.ValidatorHandler; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.w3c.dom.ls.LSResourceResolver; import org.xml.sax.Attributes; @@ -41,6 +42,7 @@ import org.xml.sax.helpers.AttributesImpl; import org.xml.sax.helpers.DefaultHandler; +@Tag("schema") class SecureValidatorHandlerTest { /** diff --git a/src/test/java/org/apache/commons/xml/SecureValidatorTest.java b/src/test/java/org/apache/commons/xml/SecureValidatorTest.java index 3da6071..32c06f8 100644 --- a/src/test/java/org/apache/commons/xml/SecureValidatorTest.java +++ b/src/test/java/org/apache/commons/xml/SecureValidatorTest.java @@ -24,6 +24,7 @@ import static org.junit.jupiter.api.Assertions.assertTrue; import java.io.IOException; +import java.util.Locale; import javax.xml.XMLConstants; import javax.xml.transform.Result; @@ -31,6 +32,7 @@ import javax.xml.validation.SchemaFactory; import javax.xml.validation.Validator; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.w3c.dom.ls.LSResourceResolver; import org.xml.sax.ErrorHandler; @@ -39,6 +41,7 @@ import org.xml.sax.SAXNotSupportedException; import org.xml.sax.helpers.DefaultHandler; +@Tag("schema") class SecureValidatorTest { private static final class PropertyValidator extends Validator { @@ -116,7 +119,8 @@ void preservesNonRemovableResolverFloorAndForwardsConfiguration() throws Excepti assertNull(validator.getResourceResolver()); validator.setResourceResolver(resolver); validator.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - validator.setProperty(TestConstants.ACCESS_EXTERNAL_SCHEMA, ""); + validator.setProperty(TestConstants.LOCALE_PROPERTY, Locale.ROOT); + assertEquals(Locale.ROOT, validator.getProperty(TestConstants.LOCALE_PROPERTY)); assertSame(resolver, validator.getResourceResolver()); assertTrue(validator.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)); assertThrows(SAXNotRecognizedException.class, () -> validator.getProperty(TestConstants.ACCESS_EXTERNAL_SCHEMA)); diff --git a/src/test/java/org/apache/commons/xml/SecureXMLFilterTest.java b/src/test/java/org/apache/commons/xml/SecureXMLFilterTest.java index 8ff4b79..f656ea5 100644 --- a/src/test/java/org/apache/commons/xml/SecureXMLFilterTest.java +++ b/src/test/java/org/apache/commons/xml/SecureXMLFilterTest.java @@ -21,6 +21,7 @@ import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertSame; import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.junit.jupiter.api.Assertions.assertTrue; import java.io.IOException; import java.io.StringReader; @@ -37,6 +38,7 @@ import javax.xml.transform.URIResolver; import javax.xml.transform.stream.StreamSource; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.xml.sax.Attributes; import org.xml.sax.InputSource; @@ -46,6 +48,7 @@ import org.xml.sax.helpers.DefaultHandler; import org.xml.sax.helpers.XMLFilterImpl; +@Tag("trax") class SecureXMLFilterTest { private static SecureXMLFilter filter() throws Exception { @@ -218,7 +221,7 @@ public void warning(final SAXParseException e) throws SAXException { } @Test - void wrapsIoFailuresFromTheParentReader() throws Exception { + void surfacesIoFailuresFromTheParentReader() throws Exception { final SecureXMLFilter filter = filter(); filter.setContentHandler(new DefaultHandler()); filter.setParent(new XMLFilterImpl() { @@ -228,7 +231,10 @@ public void parse(final InputSource input) throws IOException { throw new IOException("parent"); } }); - final SAXException exception = assertThrows(SAXException.class, () -> filter.parse(new InputSource(new StringReader("<root/>")))); - assertNotNull(exception.getCause()); + // XSLTC wraps the failure in a SAXException, Xalan hands the filter a cause it rethrows as the original IOException, and Saxon reports a SAXException + // with no linked cause: the portable contract is that the parse fails with a declared exception instead of returning a truncated result. + final Exception exception = assertThrows(Exception.class, () -> filter.parse(new InputSource(new StringReader("<root/>")))); + assertTrue(exception instanceof SAXException || exception instanceof IOException, + "parse must fail with a declared exception type: " + exception); } } diff --git a/src/test/java/org/apache/commons/xml/SecureXMLReaderTest.java b/src/test/java/org/apache/commons/xml/SecureXMLReaderTest.java index f7be826..56659ff 100644 --- a/src/test/java/org/apache/commons/xml/SecureXMLReaderTest.java +++ b/src/test/java/org/apache/commons/xml/SecureXMLReaderTest.java @@ -25,11 +25,13 @@ import javax.xml.parsers.SAXParserFactory; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.xml.sax.InputSource; import org.xml.sax.helpers.DefaultHandler; import org.xml.sax.helpers.XMLFilterImpl; +@Tag("sax") class SecureXMLReaderTest { private static final class RecordingReader extends XMLFilterImpl { diff --git a/src/test/java/org/apache/commons/xml/SecureXPathExpressionTest.java b/src/test/java/org/apache/commons/xml/SecureXPathExpressionTest.java index 4622fbc..2b517da 100644 --- a/src/test/java/org/apache/commons/xml/SecureXPathExpressionTest.java +++ b/src/test/java/org/apache/commons/xml/SecureXPathExpressionTest.java @@ -24,9 +24,11 @@ import javax.xml.xpath.XPathConstants; import javax.xml.xpath.XPathFactory; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.xml.sax.InputSource; +@Tag("xpath") class SecureXPathExpressionTest { @Test diff --git a/src/test/java/org/apache/commons/xml/SecureXPathFactoryTest.java b/src/test/java/org/apache/commons/xml/SecureXPathFactoryTest.java index 170d8a0..7f1c612 100644 --- a/src/test/java/org/apache/commons/xml/SecureXPathFactoryTest.java +++ b/src/test/java/org/apache/commons/xml/SecureXPathFactoryTest.java @@ -29,8 +29,10 @@ import javax.xml.xpath.XPathFunctionResolver; import javax.xml.xpath.XPathVariableResolver; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; +@Tag("xpath") class SecureXPathFactoryTest { @Test diff --git a/src/test/java/org/apache/commons/xml/SecureXPathTest.java b/src/test/java/org/apache/commons/xml/SecureXPathTest.java index 87cac5d..0d9349b 100644 --- a/src/test/java/org/apache/commons/xml/SecureXPathTest.java +++ b/src/test/java/org/apache/commons/xml/SecureXPathTest.java @@ -37,9 +37,11 @@ import javax.xml.xpath.XPathFunctionResolver; import javax.xml.xpath.XPathVariableResolver; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import org.xml.sax.InputSource; +@Tag("xpath") class SecureXPathTest { @Test diff --git a/src/test/java/org/apache/commons/xml/TestConstants.java b/src/test/java/org/apache/commons/xml/TestConstants.java index 26738bd..d16e262 100644 --- a/src/test/java/org/apache/commons/xml/TestConstants.java +++ b/src/test/java/org/apache/commons/xml/TestConstants.java @@ -32,4 +32,13 @@ class TestConstants { * See TestConstants.ACCESS_EXTERNAL_DTD */ static final String ACCESS_EXTERNAL_DTD = "http://javax.xml.XMLConstants/property/accessExternalDTD";; + + /** JAXP 1.2 schema-language attribute, recognized by the JDK's internal and the standalone Xerces alike. */ + static final String JAXP_SCHEMA_LANGUAGE = "http://java.sun.com/xml/jaxp/properties/schemaLanguage";; + + /** Xerces external-schemaLocation property, recognized by the JDK's internal and the standalone Xerces schema loaders alike. */ + static final String EXTERNAL_SCHEMA_LOCATION = "http://apache.org/xml/properties/schema/external-schemaLocation";; + + /** Xerces locale property, recognized by the JDK's internal and the standalone Xerces validators alike. */ + static final String LOCALE_PROPERTY = "http://apache.org/xml/properties/locale";; }
