Copilot commented on code in PR #94:
URL: https://github.com/apache/commons-secure-xml/pull/94#discussion_r4000256140
##########
src/test/java/org/apache/commons/xml/secure/SecureTransformerFactoryTest.java:
##########
@@ -192,6 +193,27 @@ void rejectsDelegatesThatCannotEnableSecureProcessing() {
assertThrows(SecureException.class, () ->
SecureTransformerFactory.secure(new RejectingFeatureFactory()));
}
+ @Test
+ void rejectsForeignTemplatesFromNewTransformerHandler() throws Exception {
+ final SAXTransformerFactory factory = (SAXTransformerFactory)
SecureTransformerFactory.newInstance();
+ final Templates own = factory.newTemplates(stylesheet());
+ // A caller's own Templates wrapper, the shape a framework uses to
carry parameters onto the Transformer it hands out.
+ final Templates foreign = new Templates() {
+
+ @Override
+ public Properties getOutputProperties() {
+ return own.getOutputProperties();
+ }
+
+ @Override
+ public Transformer newTransformer() throws
TransformerConfigurationException {
+ return own.newTransformer();
+ }
+ };
+ // Xalan and XSLTC reject a Templates they did not compile with an
undeclared ClassCastException, where Saxon uses the TrAX shape.
+ assertThrows(TransformerConfigurationException.class, () ->
factory.newTransformerHandler(foreign));
Review Comment:
This regression test only checks the exception type, so it would still pass
if the new translation stopped naming the offending `Templates` class or
stopped retaining the caught `ClassCastException` as the cause, both of which
are part of the behavior described by this change. Capture the exception and
assert its message and cause as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
