ppkarwasz commented on PR #30: URL: https://github.com/apache/commons-xml/pull/30#issuecomment-5159114696
## How to read this PR This is probably one of the most disruptive PRs, since it inverts the default behavior that was there from the start. **TL;DR**: to accommodate as many users as possible, the (non-configurable) behavior of the library is as forgiving as possible. Users that want more drastic behavior will be allowed to do that themselves, e.g. set `disallow-doctype-decl` to have parsers throw (if they support the feature). However that behavior will be devoid of any security implications since the security floor is assured. Cases where this PR can *not* prevent the occurrence of exceptions or parsing errors reported through `ErrorHandler`/`ErrorListener` are those where the implementation structurally cannot proceed with empty content: - **An entity left undeclared by an emptied DTD.** Emptying an external subset or a parameter entity erases the declarations it carried, so a later reference to such an entity is undeclared. XML 1.0 section 4.1 demotes that to an unreported validity constraint (Apache Xerces conforms), but the JDK's parser reports a well-formedness fatal unless the DOCTYPE has a system identifier, and Woodstox rejects every undeclared reference unconditionally. This reaches every surface parsing with the JDK parser (DOM, SAX, schema, validation, TrAX stylesheet and input parsing) and StAX on Woodstox. - **XInclude with `parse="xml"`.** The emptied include target is not a well-formed XML document, so the include fails on every implementation; `parse="text"` completes with empty content. - **XML Schema composition and location hints.** An XSD whose `xs:import`, `xs:include` or `xs:redefine` target was emptied does not compile, and validation driven by an `xsi:schemaLocation`/`xsi:noNamespaceSchemaLocation` hint pointing at an unresolved schema fails the same way: an empty document is not a schema document. - **Secure-processing limits** (unrelated to resolution): oversized entity expansion such as Billion Laughs and similar limits still abort the parse on every implementation. Emptied `xsl:include`/`xsl:import` and `document()` are deliberately absent from this list: they now compile and evaluate to no content on every engine. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
