ppkarwasz opened a new pull request, #114: URL: https://github.com/apache/commons-secure-xml/pull/114
Fixes [COMMONSXML-20](https://issues.apache.org/jira/browse/COMMONSXML-20). On Java 8, `SecureXMLInputFactory.newDefaultFactory()` instantiates the JDK's built-in `XMLInputFactory` by class name, through the library's own class loader. In OSGi that is a bundle class loader, which cannot see `com.sun.*`, so the call fails. The class is now loaded from the bootstrap class loader. ### OSGi integration test The second commit adds `OsgiIT`, which runs the unit test suite inside an OSGi framework against the built bundle: - The built jar is installed with its generated manifest, so the test also checks that `Import-Package` resolves. - The test classes are attached to it as a fragment, so they share its class loader. A second `maven-bundle-plugin` execution (`manifest` goal) writes the fragment manifest into `target/test-classes`, and the directory is installed in place. No test jar is built or deployed. - The test harness (JUnit, Mockito, JAXB) is boot-delegated to the class path, and the frameworks' implicit parent delegation is turned off. - Failsafe runs the class twice: once with Apache Felix 7.0.5 and once with Eclipse Equinox 3.24.300. Both run on Java 8. On Java 8 without the fix, both frameworks fail `SecureXMLInputFactoryTest`, `SecureFactoriesSmokeTest` and `JaxbTest`. The thread context class loader stays the application class loader. With a bundle TCCL, some other JDK fallbacks also fail; this will be tracked in a separate issue. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
