ppkarwasz opened a new pull request, #108: URL: https://github.com/apache/commons-jelly/pull/108
> [!WARNING] > This PR was submitted automatically to smoke-test > [Apache Commons Secure XML](https://github.com/apache/commons-xml) > and has not yet been verified by a human. > It will stay a draft until a committer reviews it and marks it ready. Creates SAX parsers and readers through `org.apache.commons:commons-secure-xml` (1.0.0-SNAPSHOT until its first release) in `core`, `jelly-tags/xml` and `jelly-tags/xmlunit`. The secure factory enables XML secure processing and installs a non-removable entity-resolver floor: external DTD and entity lookups are resolved to empty content instead of being fetched, and internal entity expansion is bounded. - core `XMLParser` keeps the documented `JellyContext.setAllowDtdToCallExternalEntities(true)` opt-in working by using a plain factory on that path; the default path uses the secure factory, and a factory assigned to the protected static field still wins. - core `ParseTag`, which had no hardening at all, now creates its reader through the secure factory. - `jelly-tags/xml`: `TransformTag`'s readers and `ParseTag`'s dom4j `SAXReader` are built from the secure factory (the deprecated `org.xml.sax.driver` system property no longer selects the reader class). The `TransformerFactory` itself stays unsecured for now: Xalan, which this module puts on the class path, drops the attributes of `xsl:namespace-alias` literal result elements under secure processing (`XSLTElementProcessor` rejects "foreign" attributes as non-fatal errors), silently breaking stylesheets such as the Schematron skeleton. - `jelly-tags/xmlunit`: the assertion tags' dom4j `SAXReader`s are built from the secure factory. `jelly-tags/html` is unchanged (NekoHTML is an HTML scanner, not an XML parser). - CI and CodeQL run with `-Puse-apache-snapshots` so the SNAPSHOT dependency resolves. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
