This is an automated email from the ASF dual-hosted git repository. ppkarwasz pushed a commit to branch feat/use-commons-xml in repository https://gitbox.apache.org/repos/asf/commons-geometry.git
commit 2ce771f34912aeab08f356a7fd8bcb89d23c6817 Author: Piotr P. Karwasz <[email protected]> AuthorDate: Mon Aug 31 15:22:22 2026 +0200 Harden XML output via commons-secure-xml Create the tutorial SVG writer's document builder and transformer factories through org.apache.commons:commons-secure-xml. The secure factories enable FEATURE_SECURE_PROCESSING and bound resource usage, regardless of the JAXP implementation on the classpath. The writer only builds an in-memory DOM and serializes it, so the generated SVG is unchanged. Changes: - Add the commons-secure-xml dependency (1.0.0-SNAPSHOT until its first release) to the examples-tutorials module. - Route factory creation through SecureDocumentBuilderFactory and SecureTransformerFactory in BSPTreeSVGWriter. - Run the CI build with -Puse-apache-snapshots (inherited from the org.apache:apache parent POM) so the commons-secure-xml SNAPSHOT resolves when the examples profile is active. Assisted-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MHgnMnGWHQoH2zD2jFdoMT --- .github/workflows/maven.yml | 2 +- commons-geometry-examples/examples-tutorials/pom.xml | 6 ++++++ .../commons/geometry/examples/tutorials/bsp/BSPTreeSVGWriter.java | 6 ++++-- src/changes/changes.xml | 4 ++++ 4 files changed, 15 insertions(+), 3 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 2b325b7e..6bea562c 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -45,4 +45,4 @@ jobs: cache: 'maven' - name: Build with Maven including examples # Use the default goal - run: mvn --show-version --batch-mode --no-transfer-progress -P commons-geometry-examples + run: mvn --show-version --batch-mode --no-transfer-progress -P commons-geometry-examples -P use-apache-snapshots diff --git a/commons-geometry-examples/examples-tutorials/pom.xml b/commons-geometry-examples/examples-tutorials/pom.xml index ba3c483f..260ac2f3 100644 --- a/commons-geometry-examples/examples-tutorials/pom.xml +++ b/commons-geometry-examples/examples-tutorials/pom.xml @@ -67,6 +67,12 @@ <artifactId>commons-geometry-io-euclidean</artifactId> </dependency> + <dependency> + <groupId>org.apache.commons</groupId> + <artifactId>commons-secure-xml</artifactId> + <version>1.0.0-SNAPSHOT</version> + </dependency> + <!-- testing --> <dependency> <groupId>org.junit.jupiter</groupId> diff --git a/commons-geometry-examples/examples-tutorials/src/main/java/org/apache/commons/geometry/examples/tutorials/bsp/BSPTreeSVGWriter.java b/commons-geometry-examples/examples-tutorials/src/main/java/org/apache/commons/geometry/examples/tutorials/bsp/BSPTreeSVGWriter.java index 3325d979..c2b239b4 100644 --- a/commons-geometry-examples/examples-tutorials/src/main/java/org/apache/commons/geometry/examples/tutorials/bsp/BSPTreeSVGWriter.java +++ b/commons-geometry-examples/examples-tutorials/src/main/java/org/apache/commons/geometry/examples/tutorials/bsp/BSPTreeSVGWriter.java @@ -46,6 +46,8 @@ import org.apache.commons.geometry.euclidean.twod.Vector2D; import org.apache.commons.geometry.euclidean.twod.path.LinePath; import org.apache.commons.geometry.euclidean.twod.shape.Parallelogram; import org.apache.commons.numbers.core.Precision; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureTransformerFactory; import org.w3c.dom.Document; import org.w3c.dom.Element; @@ -209,7 +211,7 @@ public class BSPTreeSVGWriter { */ public void write(final RegionBSPTree2D tree, final Map<RegionNode2D, String> nodeNames, final File file) { try { - final DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory docBuilderFactory = SecureDocumentBuilderFactory.newInstance(); final DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); final Document doc = docBuilder.newDocument(); @@ -236,7 +238,7 @@ public class BSPTreeSVGWriter { writeTreeStructureArea(tree, nodeNames, root, doc); // output to the target file - final TransformerFactory transformerFactory = TransformerFactory.newInstance(); + final TransformerFactory transformerFactory = SecureTransformerFactory.newInstance(); final Transformer transformer = transformerFactory.newTransformer(); transformer.setOutputProperty(OutputKeys.INDENT, "yes"); transformer.setOutputProperty(INDENT_AMOUNT_KEY, String.valueOf(INDENT_AMOUNT)); diff --git a/src/changes/changes.xml b/src/changes/changes.xml index 2b896cf4..fe9ac2cd 100644 --- a/src/changes/changes.xml +++ b/src/changes/changes.xml @@ -63,6 +63,10 @@ Apache Commons Geometry 1.0 contains the following library modules: commons-geometry-io-core (requires Java 8+) commons-geometry-io-euclidean (requires Java 8+) "> + <action dev="pkarwasz" type="fix"> + Create XML documents and transformers in the tutorial SVG writer through + org.apache.commons:commons-secure-xml, so they run with XML secure processing enabled. + </action> <action dev="aherbert" type="update" due-to="Ivan Shuba"> Fix hash code collision for Vector2D and Vector3D. Modifies the hashCode() method to reduce collision for non-identical instances of vectors.
