garydgregory commented on code in PR #59:
URL: https://github.com/apache/commons-xml/pull/59#discussion_r3880475234
##########
src/site/markdown/threat_model.md:
##########
@@ -219,6 +218,14 @@ enforced by the reserved settings above, which a caller
cannot lift.
As in the previous case, you need to provide a secure resolver.
+- **Parser pinning.** You may set `jdk.xml.overrideDefaultParser` on a TrAX,
XPath or schema factory that recognizes it.
+ The implementation's internal parsers are never used
Review Comment:
This is confusing IMO: What implementation? The JRE, JAXP, or our library?
##########
src/main/java/org/apache/commons/xml/HardeningXPathFactory.java:
##########
@@ -65,10 +65,12 @@ public final class HardeningXPathFactory {
* functions and reflection-based extension calls are reachable
only through a locked-down Saxon {@code Configuration}, not the standard JAXP
knobs; this
* is the XPath counterpart of the Saxon exception in {@link
HardeningTransformerFactory#harden(javax.xml.transform.TransformerFactory)},
kept as a
* documented package-prefix exception because the required
hardening surface is reachable only through a vendor API.</li>
- * <li><strong>FODP</strong> ({@code jdk.xml.overrideDefaultParser},
set to {@code false}): best-effort. On the stock JDK it pins the internal
parser lookup to
- * the bundled SAX parser, blocking a system property swap to a
third-party parser (defense-in-depth); Xalan rejects the feature and is left
unchanged.</li>
* <li><strong>FSP</strong> ({@link
javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING}): required. It is the only
knob both the stock JDK and Xalan XPath
* engines expose, and switches on their secure-processing limits.
{@link XPathFactory} has no attribute API for finer control.</li>
+ * <li><strong>FODP</strong> ({@value
HardeningSAXParserFactory#OVERRIDE_DEFAULT_PARSER}): read, not set. The
engine's internal parser is never used (the
Review Comment:
Same as below. What "engine"?
##########
src/main/java/org/apache/commons/xml/HardeningXPathFactory.java:
##########
@@ -246,14 +226,29 @@ public boolean isObjectModelSupported(final String
objectModel) {
@Override
public XPath newXPath() {
final XPath xpath = delegate.newXPath();
- return xpath == null ? null : new HardeningXPath(xpath);
+ return xpath == null ? null : new HardeningXPath(xpath,
useDefaultParser());
}
@Override
public void setFeature(final String name, final boolean value) throws
XPathFactoryConfigurationException {
delegate.setFeature(name, value);
}
+ /**
+ * Whether {@code jdk.xml.overrideDefaultParser} on the delegate
currently asks for the platform's built-in parser; the engine's internal parser
is
Review Comment:
> the engine's internal parser
What engine? The XPath Engine? Which one? The JRE, a JAXP impl on the
classpath, our overrides here?
Sorry, this all of this does not read clearly to me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
