kwin commented on code in PR #112:
URL:
https://github.com/apache/commons-secure-xml/pull/112#discussion_r4221033850
##########
src/main/java/org/apache/commons/xml/secure/SecureXMLReader.java:
##########
@@ -137,6 +137,8 @@ public void setEntityResolver(final EntityResolver
resolver) {
@Override
public void setErrorHandler(final ErrorHandler handler) {
+ // as soon as the error handler is populated (even with a warning),
the strict Xalan XSLT parser will throw!
+ //floor.setErrorHandler(handler);
Review Comment:
This is a full stack trace of a failed test with this line enabled (Java 21):
```
[ERROR]
org.apache.commons.xml.secure.ExternalDtdTest.secureTemplatesDoesNotLeak --
Time elapsed: 0 s <<< FAILURE!
org.opentest4j.AssertionFailedError: Secured Templates parse must not throw
==> Unexpected exception thrown:
javax.xml.transform.TransformerConfigurationException: External resource fetch
forbidden by org.apache.commons.xml.secure.throwOnUnresolved: type=null,
namespace=null, publicId=null,
systemId=file:/Users/715508/git/apache-commons/commons-secure-xml/target/test-classes/leaked/referenced.dtd,
baseURI=test:fixture
at
org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:152)
at
org.junit.jupiter.api.AssertDoesNotThrow.createAssertionFailedError(AssertDoesNotThrow.java:84)
at
org.junit.jupiter.api.AssertDoesNotThrow.assertDoesNotThrow(AssertDoesNotThrow.java:75)
at
org.junit.jupiter.api.AssertDoesNotThrow.assertDoesNotThrow(AssertDoesNotThrow.java:62)
at
org.junit.jupiter.api.Assertions.assertDoesNotThrow(Assertions.java:3280)
at
org.apache.commons.xml.secure.AttackTestSupport.assertNoLeakStrict(AttackTestSupport.java:378)
at
org.apache.commons.xml.secure.AttackTestSupport.assertTemplatesDoesNotLeak(AttackTestSupport.java:769)
at
org.apache.commons.xml.secure.AttackTestSupport.assertTemplatesDoesNotLeak(AttackTestSupport.java:762)
at
org.apache.commons.xml.secure.ExternalDtdTest.secureTemplatesDoesNotLeak(ExternalDtdTest.java:104)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)
Caused by: javax.xml.transform.TransformerConfigurationException: External
resource fetch forbidden by org.apache.commons.xml.secure.throwOnUnresolved:
type=null, namespace=null, publicId=null,
systemId=file:/Users/715508/git/apache-commons/commons-secure-xml/target/test-classes/leaked/referenced.dtd,
baseURI=test:fixture
at
java.xml/com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl.newTemplates(TransformerFactoryImpl.java:1077)
at
org.apache.commons.xml.secure.SecureTransformerFactory$Wrapper.newTemplates(SecureTransformerFactory.java:286)
at
org.apache.commons.xml.secure.AttackTestSupport.strictTemplates(AttackTestSupport.java:1216)
at
org.apache.commons.xml.secure.AttackTestSupport.templatesCompileAndTransform(AttackTestSupport.java:1291)
at
org.apache.commons.xml.secure.AttackTestSupport.lambda$assertTemplatesDoesNotLeak$40(AttackTestSupport.java:769)
at
org.junit.jupiter.api.AssertDoesNotThrow.assertDoesNotThrow(AssertDoesNotThrow.java:71)
... 9 more
Caused by: org.xml.sax.SAXParseException; External resource fetch forbidden
by org.apache.commons.xml.secure.throwOnUnresolved: type=null, namespace=null,
publicId=null,
systemId=file:/Users/715508/git/apache-commons/commons-secure-xml/target/test-classes/leaked/referenced.dtd,
baseURI=test:fixture
at
org.apache.commons.xml.secure.FallbackIgnoreEntityResolver2.onUnresolved(FallbackIgnoreEntityResolver2.java:122)
at
org.apache.commons.xml.secure.FallbackIgnoreEntityResolver2.resolveEntity(FallbackIgnoreEntityResolver2.java:144)
at
java.xml/com.sun.org.apache.xerces.internal.util.EntityResolver2Wrapper.resolveEntity(EntityResolver2Wrapper.java:178)
at
java.xml/com.sun.org.apache.xerces.internal.impl.XMLEntityManager.resolveEntityAsPerStax(XMLEntityManager.java:1027)
at
java.xml/com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$DTDDriver.dispatch(XMLDocumentScannerImpl.java:1142)
at
java.xml/com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$DTDDriver.next(XMLDocumentScannerImpl.java:1040)
at
java.xml/com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl$PrologDriver.next(XMLDocumentScannerImpl.java:943)
at
java.xml/com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(XMLDocumentScannerImpl.java:605)
at
java.xml/com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next(XMLNSDocumentScannerImpl.java:114)
at
java.xml/com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(XMLDocumentFragmentScannerImpl.java:542)
at
java.xml/com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:889)
at
java.xml/com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:825)
at
java.xml/com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:141)
at
java.xml/com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.parse(AbstractSAXParser.java:1224)
at
java.xml/com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.parse(SAXParserImpl.java:637)
at
org.apache.commons.xml.secure.SecureXMLReader.parse(SecureXMLReader.java:107)
at
java.xml/com.sun.org.apache.xalan.internal.xsltc.compiler.Parser.parse(Parser.java:439)
at
java.xml/com.sun.org.apache.xalan.internal.xsltc.compiler.XSLTC.compile(XSLTC.java:481)
at
java.xml/com.sun.org.apache.xalan.internal.xsltc.compiler.XSLTC.compile(XSLTC.java:575)
at
java.xml/com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl.newTemplates(TransformerFactoryImpl.java:1036)
... 14 more
```
So it is JRE's private shaded copy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
