ppkarwasz commented on code in PR #43: URL: https://github.com/apache/commons-xml/pull/43#discussion_r3857068254
########## src/site/markdown/threat_model.md: ########## @@ -74,7 +74,12 @@ because your reader's settings are indistinguishable from configuration you chos ### What is in scope -- The hardening recipes applied by `XmlFactories` to the JAXP implementations it recognizes (stock JDK, Apache Xerces, Xalan, Saxon, and Woodstox). +- The hardening recipes applied by `XmlFactories`. + Every JAXP implementation is in scope, Review Comment: Good point: pinned in 5beea39. JAXP 1.4 introduced StaX and the DOM/SAX/TraX resolver hooks, so we need at least this version. Most implementations don't implement JAXP 1.5, so there is no reason to go higher. Note that some restrictions are mentioned one line below: ``` as long as it respects the contract of the features, attributes, and properties the recipes use. ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
