ppkarwasz opened a new pull request, #70: URL: https://github.com/apache/commons-secure-xml/pull/70
`MethodHandleFactory.invokeExact` wrapped every throwable that was not of the declared rethrow type in `IllegalStateException` — including undeclared JVM `Error`s. An `OutOfMemoryError` raised mid-lookup was thereby demoted from `Error` to `RuntimeException`, hiding it from supervisors that handle `Error` separately and conflating it with securing failures (`SecureException` also extends `IllegalStateException`). The fix rethrows an undeclared `Error` unchanged before the wrap, leaving `IllegalStateException` to cover runtime exceptions only (the looked-up `newDefault*` factory methods declare no other checked exceptions). Tests now assert instance identity, not just type, on both rethrow paths, and a new test drives an `OutOfMemoryError` through the helper. This completes the remainder of a scan finding whose headline defect — the inverted `e.getClass().isInstance(rethrow)` check that made the declared-type rethrow dead code — was already fixed in `cd2a7a4`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
