garydgregory commented on code in PR #288:
URL: https://github.com/apache/commons-jxpath/pull/288#discussion_r3945029288
##########
src/main/java/org/apache/commons/jxpath/xml/JDOMParser.java:
##########
@@ -40,7 +45,19 @@ public Object parseXML(final InputStream stream) {
throw new JXPathException("JDOM parser configuration error. JDOM
does not support the namespaceAware=false setting.");
}
try {
- final SAXBuilder builder = new SAXBuilder();
+ // JDOM builds its reader through JAXP internally; hand it one
from the secure factory instead.
+ final SAXBuilder builder = new SAXBuilder() {
+ @Override
+ protected XMLReader createParser() throws JDOMException {
+ try {
+ final SAXParserFactory factory =
SecureSAXParserFactory.newNSInstance();
+ factory.setValidating(isValidating());
+ return factory.newSAXParser().getXMLReader();
+ } catch (final Exception ex) {
+ throw new JDOMException("Unable to create a new XML
reader", ex);
+ }
+ }
+ };
Review Comment:
Yes, that would be a good update! I'm not sure if JDOM 1 objects have leaked
into public or protected API signatures though... that would be a non-starter
with a major release line. Let's if I resolved the conflicts correctly in the
GH web UI: https://github.com/apache/commons-jxpath/pull/87/
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
