[
https://issues.apache.org/jira/browse/JCR-5265?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18125040#comment-18125040
]
Konrad Windszus commented on JCR-5265:
--------------------------------------
bq. I'm completely convinced.
and
bq. Why don't we just fix what we have, if it needs fixing?
are a bit contradicting, as the whole point of using Apache Commons Secure XML
is you don't need to worry about what needs to be fixed for which specific
implementation. I currently haven't found a way to bypass our secure factories,
however it is pretty likely that you can (e.g. by using a different JAXP impl).
The ASF one by default doesn't throw however but just tries to parse without
resolving external entities (i.e. leaving them replaced by blank) but that
behaviour is configurable.
> Adopt Apache Commons Secure XML
> -------------------------------
>
> Key: JCR-5265
> URL: https://issues.apache.org/jira/browse/JCR-5265
> Project: Jackrabbit Content Repository
> Issue Type: Improvement
> Components: jackrabbit-jcr-commons
> Reporter: Konrad Windszus
> Priority: Major
>
> Instead of leveraging the helpers introduced with JCR-5195 I suggest using
> [https://commons.apache.org/proper/commons-secure-xml.|https://commons.apache.org/proper/commons-secure-xml/]
> It has the advantage that it is secure irrespective of the underlying JAXP
> implementation being used. Further information in
> [https://commons.apache.org/proper/commons-secure-xml/apidocs/index.html#why-heading].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
