ppkarwasz opened a new pull request, #40: URL: https://github.com/apache/commons-xml/pull/40
## Summary Addresses findings **f003** (`newXMLFilter` bypasses hardening) and **f004** (`TemplatesHandler`/`TransformerHandler` products escape runtime hardening). Both concern the `SAXTransformerFactory` extension methods. For this first release we promise hardening for the standard entry points of the specific JAXP factory types `XmlFactories` returns. The `SAXTransformerFactory` extension methods (`newTransformerHandler(...)`, `newTemplatesHandler()`, `newXMLFilter(...)`) and the `TransformerHandler`, `TemplatesHandler`, `Templates` and `XMLFilter` objects they produce are **out of scope**, so this PR documents that rather than changing behavior. ## Changes - **`XmlFactories.newTransformerFactory()` Javadoc**: narrows the previously unconditional "the guarantees apply to every parser the factory creates internally" to the standard `TransformerFactory` entry points (`newTemplates(Source)` / `newTransformer(Source)` compilation and `Transformer.transform(Source, Result)`), and states the `SAXTransformerFactory` extension methods and their products are not hardened this release. It no longer promises the runtime type of the returned factory (the extension methods are described as reachable *if* the returned factory is cast). - **`threat_model.md`**: clarifies *What is in scope*; adds a *What is out of scope* bullet and a *Known non-findings* bullet for the extension surface. - **`index.md`**: adds a short *Transformer handlers and filters* note. ## Notes - Documentation only; no behavior change. The methods keep working, they are simply not covered by the guarantee. - Prose under `src/site/markdown` uses semantic line breaks. - Insertion points were chosen to not overlap the other open doc PRs (#38, #39), so the three merge in any order. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
