The GitHub Actions job "Java CI" on commons-jxpath.git/master has failed. Run started by GitHub user garydgregory (triggered by garydgregory).
Head commit for run: 9024498413b6c2f6ab8e744a5089cbe4088a8ad0 / Piotr P. Karwasz <[email protected]> Harden XML parsing via commons-secure-xml (#288) * Harden XML parsing via commons-secure-xml Create XML parsers and transformers through org.apache.commons:commons-secure-xml. The secure factories enable FEATURE_SECURE_PROCESSING and install a non-removable entity-resolver floor on every parser they produce: external DTD, entity, schema and XInclude lookups that a caller-set resolver does not resolve are resolved to empty content instead of being fetched, and internal entity expansion is bounded, regardless of the JAXP implementation on the classpath. Changes: - Add the commons-secure-xml dependency (1.0.0-SNAPSHOT until its first release). - Route factory creation through SecureDocumentBuilderFactory in DOMParser and SecureTransformerFactory in XMLDocumentContainer; the caller-configurable factory settings (validation, namespace awareness, entity expansion, whitespace, comments, coalescing) keep working. - JDOMParser builds its SAX reader through the secure factory as well, by overriding SAXBuilder.createParser(); documents with internal DTD subsets parse as before. - Parsers registered through DocumentContainer.registerXMLParser remain under the control of their authors. - Run the CI and CodeQL builds with -Puse-apache-snapshots (inherited from the org.apache:apache parent POM) so the commons-secure-xml SNAPSHOT resolves; CodeQL's autobuild receives the profile through MAVEN_ARGS. Assisted-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MHgnMnGWHQoH2zD2jFdoMT * Use the Commons Secure XML 1.0.0 release candidate Bump org.apache.commons:commons-secure-xml from 1.0.0-SNAPSHOT to 1.0.0 and add the temporary staging repository https://repository.apache.org/content/repositories/orgapachecommons-1962/ after Central, so the vote gets downstream CI results. Drop the -Puse-apache-snapshots profile from the CI workflows, which the release version no longer needs. Remove the staging repository once 1.0.0 is released. Assisted-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_0167e29ScPEdfzJnEFm95imK * Bump Apache Commons Secure XML from 1.0.0-SNAPSHOT to 1.0.0 --------- Co-authored-by: Gary Gregory <[email protected]> Report URL: https://github.com/apache/commons-jxpath/actions/runs/34034513821 With regards, GitHub Actions via GitBox
