jmestwa-coder commented on PR #4198: URL: https://github.com/apache/logging-log4j2/pull/4198#issuecomment-5163932057
makes sense, reworked it along those lines: - reverted the parser features and `setValidating(false)`; dtd validation stays enabled as before - `Log4jEntityResolver` still serves the bundled `log4j.dtd`, but now returns an empty source instead of `null` for anything else, so the policy is enforced through the resolver and doesn't depend on the JAXP provider - it logs a status warning with the public/system id when it ignores a resource, so configs that relied on external entities get a visible hint instead of a silent behavior change - test unchanged, full log4j-1.2-api suite passes agreed the validation behavior is a separate topic, so I left the `log4j.dtd` cleanup/strictening out of this PR. commons-xml looks like the right long-term home for the generic hardening once it's usable. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
