ppkarwasz commented on PR #41: URL: https://github.com/apache/commons-xml/pull/41#issuecomment-5342127103
The Android instrumented-test failure is fixed in 0aeac4b. **Root cause:** `XMLFilterTest`'s unconfigured controls built a plain Xalan filter and called `parse()` with no parent, so Xalan's `TrAXFilter` self-provisioned a reader and set `namespace-prefixes=true` on it (only in the no-parent branch). On Android that reader is libexpat, which accepts the feature at `setFeature` time but fails mid-parse. **Fix (test-only):** on Android the unconfigured controls now hand the filter a permissive parent (`AttackTestSupport.permissiveReader`, wrapping the Expat reader to reject `namespace-prefixes` eagerly like the production `HardeningExpatXMLReader`), so `TrAXFilter` uses it directly instead of self-provisioning. `unconfiguredFilterLeaksExternalEntity` additionally skips on Android, whose Expat does not resolve the external general entity in this path (nothing to leak); its hardened counterpart still runs on device and does not leak. **Verified:** full `mvn clean` + `mvn` matrix green, and `connectedAndroidTest` on a Pixel 6a API 33 emulator now passes (132 tests, 0 failures) with all hardened `XMLFilterTest` cases green. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
