ppkarwasz opened a new pull request, #766: URL: https://github.com/apache/commons-text/pull/766
> [!WARNING] > This PR was submitted automatically to smoke-test > [Apache Commons Secure XML](https://github.com/apache/commons-xml) > and has not yet been verified by a human. > It will stay a draft until a committer reviews it and marks it ready. Creates `XmlStringLookup`'s document builder and XPath factories through `org.apache.commons:commons-secure-xml` (1.0.0-SNAPSHOT until its first release) on the default path. The secure factories enable XML secure processing and install a non-removable entity-resolver floor: external DTD and entity lookups are resolved to empty content instead of being fetched, and internal entity expansion is bounded. The documented `XmlStringLookup.secure=false` system property keeps its meaning: that path still uses the plain JAXP factories, so external entity resolution can be restored where it is wanted. The secure-path tests are adapted to the secure contract: a parser may either reject a document with an external reference or parse it with the reference resolved to empty content, so they now assert that the external content does not leak into the result instead of expecting one fixed failure mode. CI and CodeQL run with `-Puse-apache-snapshots` so the SNAPSHOT dependency resolves. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
