ppkarwasz commented on code in PR #59:
URL: https://github.com/apache/commons-xml/pull/59#discussion_r3881729809
##########
src/main/java/org/apache/commons/xml/HardeningXPathFactory.java:
##########
@@ -65,10 +65,12 @@ public final class HardeningXPathFactory {
* functions and reflection-based extension calls are reachable
only through a locked-down Saxon {@code Configuration}, not the standard JAXP
knobs; this
* is the XPath counterpart of the Saxon exception in {@link
HardeningTransformerFactory#harden(javax.xml.transform.TransformerFactory)},
kept as a
* documented package-prefix exception because the required
hardening surface is reachable only through a vendor API.</li>
- * <li><strong>FODP</strong> ({@code jdk.xml.overrideDefaultParser},
set to {@code false}): best-effort. On the stock JDK it pins the internal
parser lookup to
- * the bundled SAX parser, blocking a system property swap to a
third-party parser (defense-in-depth); Xalan rejects the feature and is left
unchanged.</li>
* <li><strong>FSP</strong> ({@link
javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING}): required. It is the only
knob both the stock JDK and Xalan XPath
* engines expose, and switches on their secure-processing limits.
{@link XPathFactory} has no attribute API for finer control.</li>
+ * <li><strong>FODP</strong> ({@value
HardeningSAXParserFactory#OVERRIDE_DEFAULT_PARSER}): read, not set. The
engine's internal parser is never used (the
Review Comment:
I dropped the bullet in
https://github.com/apache/commons-xml/pull/59/commits/aa9d38597e773131b569dbdbb6883af8538b1f17.
FODP is not used in that method anyway.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
