This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
The following commit(s) were added to refs/heads/main by this push:
new 51879f6 Fix merge conflict in changes.xml
51879f6 is described below
commit 51879f6a08a9f2ffe2bee89eaf5b1c7228d63065
Author: Piotr P. Karwasz <[email protected]>
AuthorDate: Wed Aug 26 13:25:15 2026 +0200
Fix merge conflict in changes.xml
---
src/changes/changes.xml | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 3cee5a5..a4063f3 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -32,11 +32,6 @@ The <action> type attribute can be add, update, fix, or
remove.
</properties>
<body>
<release version="0.1.0" date="YYYY-MM-DD" description="First release.">
- <action type="add" dev="ppkarwasz">
- Secure-by-default JAXP factory creation via XmlFactories, with
implementation-specific hardening recipes for the
- stock JDK, Android, Apache Xalan, Apache Xerces, Woodstox, and
Saxon-HE.
- </action>
- <action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary
Gregory">Harden the document parse behind the InputSource-taking XPath
evaluation entry points.</action>
<!-- ADD -->
<action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary
Gregory">Add secure-by-default JAXP factory creation via XmlFactories, donated
from the copernik-xml-factory project
(https://github.com/copernik-eu/copernik-xml-factory) and covering the stock
JDK, Android, Apache Xalan, Apache Xerces, Woodstox, and Saxon-HE.</action>
<action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary
Gregory" issue="COMMONSXML-9">Install a non-removable resolver floor on every
resolver channel (EntityResolver, LSResourceResolver, URIResolver, and
XMLResolver), routing caller-supplied resolvers through it as
allow-lists.</action>
@@ -47,6 +42,7 @@ The <action> type attribute can be add, update, fix, or
remove.
<action type="fix" dev="ppkarwasz" due-to="Ta Duc Thien, Piotr P.
Karwasz, Gary Gregory" issue="COMMONSXML-10">Block XInclude (xi:include) href
resolution by default, since the JAXP external-access properties do not govern
it.</action>
<action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary
Gregory">Restore the hardened configuration when a factory or parser is reset()
instead of reverting to the implementation defaults.</action>
<action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary
Gregory">Parse a Source opted in by a caller-supplied URIResolver using a
hardened parser.</action>
+ <action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary
Gregory">Harden the document parse behind the InputSource-taking XPath
evaluation entry points.</action>
<!-- UPDATE -->
<action type="update" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary
Gregory"
issue="COMMONSXML-1,COMMONSXML-5,COMMONSXML-6,COMMONSXML-7,COMMONSXML-8">Recognize
XML implementations by the JAXP features and properties they support instead
of by their implementation class name, extending the hardening to any compliant
implementation.</action>
<action type="update" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary
Gregory" issue="COMMONSXML-4">Define a consistent contract for denied external
fetches: unresolved external references resolve to empty content on every
implementation, unless the org.apache.commons.xml.throwOnUnresolved system
property requests rejection.</action>
