ppkarwasz opened a new pull request, #17: URL: https://github.com/apache/commons-xml/pull/17
JIRA: https://issues.apache.org/jira/browse/COMMONSXML-8 Applies the capability-driven approach of [COMMONSXML-1](https://issues.apache.org/jira/browse/COMMONSXML-1) to the last two paths, TrAX and XPath, with Saxon kept as the single documented class-name exception (a locked-down `Configuration`, handled by the unchanged `SaxonProvider`). `StockJdkProvider` and `XalanProvider` are removed, and the two hardeners are named after the product (`TransformerHardener`, `XPathHardener`) to match `DocumentBuilderHardener` and `SAXParserHardener`. One change is worth noting on the TrAX path: - **`ACCESS_EXTERNAL_STYLESHEET` is dropped** in favor of the deny-all `URIResolver`, which already blocks the same channel (`xsl:import`/`xsl:include`, `document()`) uniformly across XSLTC and Xalan. - **`ACCESS_EXTERNAL_DTD` could not be dropped.** The JDK XSLTC copies this factory attribute onto the reader it uses to parse the stylesheet (`Util.getInputSource`), overwriting the value our hardened reader had set, so it is required there; Xalan rejects it and is covered by the hardened reader instead. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
