ppkarwasz opened a new pull request, #35: URL: https://github.com/apache/commons-xml/pull/35
## What The JAXP `reset()` contract reverts a parser, validator, or transformer to its just-created state. The hardened wrappers install part of their protection after creation (resolver floors, cached hardened views), and several JAXP implementations take the contract literally and revert that state. Each wrapper now restores its just-constructed hardening on `reset()`, matching what `HardeningDocumentBuilder.reset()` already did: - `HardeningSAXParser.reset()` drops its cached reader and parser views, so the next `getXMLReader()` or `getParser()` call runs the freshly reset reader through the hardening funnel again. - `HardeningValidator.reset()` re-establishes the bare resource-resolver floor. - `HardeningTransformer.reset()` re-establishes the URI-resolver floor, seeded again with the factory's compile-time resolver. ## Tests The new `ResetHardeningTest` covers the three lifecycle paths: each test resets a hardened object and asserts that an external reference is still either blocked or resolved to empty content afterwards, and skips on platforms whose implementation does not support `reset()` at all. All three were verified to fail before the fix on at least one supported stack. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
