Author: ggregory Date: Mon Oct 5 21:49:36 2026 New Revision: 1938811 Log: Update threat model per discussion on the ML https://lists.apache.org/thread.html/tckwj80shttndvnftoltk6g3fz2nrmcn
Modified: commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md Modified: commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md ============================================================================== --- commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md Mon Oct 5 20:10:04 2026 (r1938810) +++ commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md Mon Oct 5 21:49:36 2026 (r1938811) @@ -334,11 +334,8 @@ the family does not take on an adversary Commons accepts input only through public API parameters. **The exception, a narrow default-configuration promise:** -for **Compress, Configuration, Text, and FileUpload**, -passing any data to them in their default configuration will not: +Components will not: -- cause excessive CPU consumption, -- cause excessive memory allocation, - execute remote code. This promise covers availability and integrity only.
