[
https://issues.apache.org/jira/browse/TIKA-4935?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120282#comment-18120282
]
Hudson commented on TIKA-4935:
------------------------------
SUCCESS: Integrated in Jenkins build Tika » tika-main-jdk17 #1683 (See
[https://ci-builds.apache.org/job/Tika/job/tika-main-jdk17/1683/])
[TIKA-4935] Delegate JAXP parser configuration to Apache Commons Secure (#3262)
(github:
[https://github.com/apache/tika/commit/6620738735af7c7fdf36495551d489c13344a51e])
* (edit) tika-core/src/main/java/org/apache/tika/utils/XMLReaderUtils.java
* (edit) tika-core/src/test/java/org/apache/tika/utils/XMLReaderUtilsTest.java
> Delegate JAXP parser configuration to Apache Commons Secure XML
> ---------------------------------------------------------------
>
> Key: TIKA-4935
> URL: https://issues.apache.org/jira/browse/TIKA-4935
> Project: Tika
> Issue Type: Improvement
> Reporter: Gary D. Gregory
> Priority: Minor
> Fix For: 4.1.0
>
>
> Tika maintains custom XML security configuration across SAX, DOM, StAX, and
> XSLT processing. Adopt Apache Commons Secure XML 1.0.0 to centralize these
> protections and reduce duplicated configuration and resolver code.
> PR [3261|https://github.com/apache/tika/pull/3261]:
> * Uses Commons Secure XML factories in {{{}XMLReaderUtils{}}}, MIME type
> loading, and XML-related tests.
> * Removes manual SAX/DOM feature configuration, transformer external-access
> attributes, and the custom StAX fallback resolver.
> * Retains Tika’s configurable entity expansion limits, parser pooling, DOM
> entity-reference settings, and StAX restrictions on DTD and external entity
> processing.
> * Routes async configuration writer document and transformer creation
> through {{{}XMLReaderUtils{}}}.
> * Adds Maven dependencies and updates the OSGi integration-test setup.
> Regression tests cover external entity blocking and external resource access
> through XSLT {{{}document(){}}}, {{{}xsl:include{}}}, and {{xsl:import}} for
> both transformer factory getters. They also verify that explicitly supplied
> resolvers remain usable and that the async writer can create new XML
> configurations and preserve existing configuration content.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
