ppkarwasz opened a new pull request, #96: URL: https://github.com/apache/commons-secure-xml/pull/96
Fixes [COMMONSXML-17](https://issues.apache.org/jira/browse/COMMONSXML-17). `SecureTransformer` seeded the floor from the factory's resolver alone and overwrote whatever the delegate already carried. It now seeds from the delegate's own resolver, falling back to the factory's, and skips one that is already a `FallbackIgnoreURIResolver` so floors do not nest; `reset()` restores the same seed. The resolver threaded down from the factory is renamed `factoryUriResolver`, since it is now the fallback rather than the only seed. Tests cover the constructor, the floor still catching what an adopted resolver declines, and both entry points that expose the defect — `newXMLFilter(Templates)` and `newTransformerHandler(Templates)` — in the shape Apache CXF's `XSLTJaxbProvider` builds. The handler test skips where the implementation can show nothing: Saxon refuses a `Templates` it did not compile, Apache Xalan overwrites the resolver itself (`TransformerFactoryImpl.newTransformerHandler`, line 698). Both conditions are measured on a plain factory, not named. `mvn clean verify`: no failures in any of the eight surefire executions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
