elharo opened a new issue, #284:
URL: https://github.com/apache/maven-dependency-analyzer/issues/284
## Bug Description
In `WarMainDependencyClassesProvider.java:142-158`, the
`processClassesFromTags` method only queries for tags within three specific XML
namespaces:
```java
private static final List<String> WEB_XML_NAMESPACES = Arrays.asList(
"https://jakarta.ee/xml/ns/jakartaee";, // Jakarta EE 9+
"http://xmlns.jcp.org/xml/ns/javaee";, // Java EE 7–8
"http://java.sun.com/xml/ns/javaee"; // Java EE 5–6
);
```
It calls `doc.getElementsByTagNameNS(namespace, tagName)` for each. If none
match, it returns zero results.
web.xml files from older Servlet specs (2.4 and earlier) or those omitting a
namespace declaration will contain plain (non-namespaced) elements like
`<servlet-class>`. Since the parser has `setNamespaceAware(true)`,
namespace-qualified queries never match unqualified elements, and no class
names are extracted.
## Impact
WAR projects using Servlet 2.4 or earlier (DTD-based web.xml), or any
web.xml without a namespace, silently produce incomplete dependency analysis.
Servlet, filter, and listener classes referenced in web.xml are **entirely
missing** from the dependency graph, potentially causing them to appear as
"unused declared" or misattributed.
## Suggested Fix
After checking all known namespaces, fall back to a non-namespace-aware
query (or use `"*"` as the namespace) to cover web.xml files without namespaces:
```java
// in processClassesFromTags, after the namespace loop:
if (classes.isEmpty()) {
NodeList tags = doc.getElementsByTagName(tagName);
for (int i = 0; i < tags.getLength(); i++) {
...
}
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
