ppkarwasz opened a new pull request, #74: URL: https://github.com/apache/commons-secure-xml/pull/74
Pushed as a branch on `apache/commons-secure-xml` rather than from a fork, so the workflow change takes effect on this PR's own run. The Zulu job exists to cover the oldest JDK 8 behaviour the securing has to work against, but the pin (8u201) already carries the 8u162 backport wave, so it exercises the same code paths as every other Java 8 job. Pinning to **8u152** — the last release before that wave — makes the job earn its place. The specific behaviour it now covers: `com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl.getAssociatedStylesheet` only started honouring the `XMLReader` carried by a `SAXSource` in 8u162. Through 8u152 it never inspects the source and always builds its own parser via `FactoryImpl.getSAXFactory`, so a reader the caller injects is discarded. Verified by reading the sources at `jdk8u152-b16` and `jdk8u162-b12`, and by running the suite locally on Zulu 8u152. `jdk.xml.overrideDefaultParser` arrived in the same backport wave, so `OverrideDefaultParserTest` would fail on 8u152 purely for lack of the feature. It now probes for it and skips where the runtime does not recognise it — no behavioural change on any JDK that does. ### Expected result on this PR The Zulu job is expected to **fail**, with exactly one distinct failure: ``` AssociatedStylesheetTest.secureGetAssociatedStylesheetIgnoresExternalDtd (stockjdk, jdk-xerces) ``` That is a real gap on pre-8u162 runtimes, not a flaw in the pin: because the injected reader is discarded, the PI scan runs on a parser the library did not configure. With external Xerces on the classpath the scan attempts the external-DTD fetch outright (reproduced locally: `ConnectException` to the unreachable host in the payload); on the stock 8u152 parser the fetch is refused by `accessExternalDTD`, so the securing is not bypassed there, but the method throws instead of completing. Every other job is unaffected: the full matrix is green on the current JDK, and on 8u152 the only failures are the two above (28 `OverrideDefaultParserTest` cases skip). So this PR is deliberately a red-CI change that makes an existing gap visible. Merge it together with, or after, the fix for that gap — or merge it first if the failing job is the more useful signal while the fix is prepared. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
