garydgregory commented on code in PR #66: URL: https://github.com/apache/commons-secure-xml/pull/66#discussion_r3905215335
########## src/site/markdown/threat_model.md: ########## @@ -132,12 +174,16 @@ JDK version and the standard `jdk.xml.*` limit properties the JDK itself reads: default `2500` on JDK 25 and `64000` on JDK 8 through 21). These are trusted deployment configuration: an operator may set one to tighten (or loosen) a limit globally, but loosening through one is reconfiguration, treated like loosening any other reserved setting (see [What is out of scope](#what-is-out-of-scope)). -- The bundled parsers apply their own hardcoded secure defaults instead (for example external Xerces and Woodstox cap - entity expansion at `100000`) and do not read `jdk.xml.*`. +- The bundled parsers apply their own hardcoded secure defaults instead Review Comment: We don't bundle any parsers with the library, so what does "bundle" mean here? Please specify if these are the parsers we depend on at test-time. Or the parsers bundled in a JRE or JDK? Or something else? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
