This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 606a49ae6bc400d8fb7b5eec0ce4f6621510f1a5 Author: Gary Gregory <[email protected]> AuthorDate: Fri Aug 28 13:24:23 2026 -0400 Rename HardeningXMLReader to SecureXMLReader. Local build OK. --- .../java/org/apache/commons/xml/SecureSAXParserFactory.java | 12 ++++++------ .../xml/{HardeningXMLReader.java => SecureXMLReader.java} | 4 ++-- .../org/apache/commons/xml/OverrideDefaultParserTest.java | 6 +++--- .../java/org/apache/commons/xml/ShadingFootprintTest.java | 8 ++++---- 4 files changed, 15 insertions(+), 15 deletions(-) diff --git a/src/main/java/org/apache/commons/xml/SecureSAXParserFactory.java b/src/main/java/org/apache/commons/xml/SecureSAXParserFactory.java index b3bd2f6..1c53b4f 100644 --- a/src/main/java/org/apache/commons/xml/SecureSAXParserFactory.java +++ b/src/main/java/org/apache/commons/xml/SecureSAXParserFactory.java @@ -89,7 +89,7 @@ public final class SecureSAXParserFactory { * configuration time rather than mid-parse.</li> * <li><strong>FSP</strong>: required on every other reader. It switches on the implementation's built-in security manager, which is what carries the * processing limits.</li> - * <li><strong>Ignore-all resolver floor</strong>: every reader is wrapped in a {@link HardeningXMLReader} that keeps an ignore-all {@link EntityResolver} floor. + * <li><strong>Ignore-all resolver floor</strong>: every reader is wrapped in a {@link SecureXMLReader} that keeps an ignore-all {@link EntityResolver} floor. * That floor blocks external DTD, entity, schema and {@code xi:include} fetches in one place: the stock JDK's XInclude processor ignores * {@code ACCESS_EXTERNAL_*} and consults the {@link EntityResolver} instead, so no {@code ACCESS_EXTERNAL_*} properties are needed here. A caller can * chain its own resolver onto the floor to allow-list resources, but cannot remove it.</li> @@ -137,7 +137,7 @@ static Source harden(final Source source, final boolean overrideDefaultParser) t * @throws IllegalStateException if a required hardening setting cannot be applied to the underlying implementation. */ static XMLReader harden(final XMLReader reader) { - if (reader instanceof HardeningXMLReader) { + if (reader instanceof SecureXMLReader) { // Already hardened (for example, a reader from a hardened factory passed back through harden(XMLReader)); the floor is already in place. return reader; } @@ -149,10 +149,10 @@ static XMLReader harden(final XMLReader reader) { } // Required: enables the JDK XMLSecurityManager / Xerces SecurityManager limits. setFeature(reader, XMLConstants.FEATURE_SECURE_PROCESSING, true); - // Required: HardeningXMLReader installs an ignore-all EntityResolver floor on the reader. + // Required: SecureXMLReader installs an ignore-all EntityResolver floor on the reader. // That floor blocks external DTD, entity, schema and xi:include fetches in one place: no ACCESS_EXTERNAL_* properties are needed here. // Callers can chain their resolvers, but not override the floor. - return new HardeningXMLReader(reader); + return new SecureXMLReader(reader); } /** @@ -318,14 +318,14 @@ private SecureSAXParserFactory() { } /** - * {@link HardeningXMLReader} for Android's {@code org.apache.harmony.xml.ExpatReader} that additionally surfaces its {@code namespace-prefixes} limitation at + * {@link SecureXMLReader} for Android's {@code org.apache.harmony.xml.ExpatReader} that additionally surfaces its {@code namespace-prefixes} limitation at * configuration time. * * <p>ExpatReader does not actually support the {@code namespace-prefixes} feature: enabling it is accepted by {@code setFeature} but fails later, during * {@code parse}, with a {@link SAXNotSupportedException}. Reporting the rejection eagerly from {@link #setFeature(String, boolean)} lets consumers that probe * the feature, such as Xalan's identity transformer, catch the exception and fall back instead of failing the whole parse.</p> */ - static final class HardeningExpatXMLReader extends HardeningXMLReader { + static final class HardeningExpatXMLReader extends SecureXMLReader { private static final String NAMESPACE_PREFIXES_FEATURE = "http://xml.org/sax/features/namespace-prefixes";; diff --git a/src/main/java/org/apache/commons/xml/HardeningXMLReader.java b/src/main/java/org/apache/commons/xml/SecureXMLReader.java similarity index 97% rename from src/main/java/org/apache/commons/xml/HardeningXMLReader.java rename to src/main/java/org/apache/commons/xml/SecureXMLReader.java index 9eae201..1dff366 100644 --- a/src/main/java/org/apache/commons/xml/HardeningXMLReader.java +++ b/src/main/java/org/apache/commons/xml/SecureXMLReader.java @@ -40,7 +40,7 @@ * * <p>Every other method forwards to the wrapped delegate; subclasses (e.g. {@code HardeningExpatXMLReader}) add per-implementation fixups on top of the floor.</p> */ -class HardeningXMLReader implements XMLReader { +class SecureXMLReader implements XMLReader { private final XMLReader delegate; @@ -52,7 +52,7 @@ class HardeningXMLReader implements XMLReader { * @param delegate the delegate to wrap; must not be {@code null}. * @throws NullPointerException if {@code delegate} is {@code null}. */ - HardeningXMLReader(final XMLReader delegate) { + SecureXMLReader(final XMLReader delegate) { this.delegate = Objects.requireNonNull(delegate, "delegate"); this.floor = new FallbackIgnoreEntityResolver2(null); delegate.setEntityResolver(floor); diff --git a/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java b/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java index 4dedd9a..0590509 100644 --- a/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java +++ b/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java @@ -64,10 +64,10 @@ private static String transform(final TransformerFactory factory, final String t @Test void hardenedReaderFollowsFlag() throws Exception { assumeFalse(AttackTestSupport.IS_ANDROID); - final XMLReader pinned = ((HardeningXMLReader) SecureSAXParserFactory.newHardenedReader(false)).getDelegate(); + final XMLReader pinned = ((SecureXMLReader) SecureSAXParserFactory.newHardenedReader(false)).getDelegate(); assertTrue(pinned.getClass().getName().startsWith(JDK_INTERNAL_PREFIX), pinned.getClass().getName()); - final XMLReader pluggable = ((HardeningXMLReader) SecureSAXParserFactory.newHardenedReader(true)).getDelegate(); - final XMLReader lookedUp = ((HardeningXMLReader) SecureSAXParserFactory.newNSInstance().newSAXParser().getXMLReader()).getDelegate(); + final XMLReader pluggable = ((SecureXMLReader) SecureSAXParserFactory.newHardenedReader(true)).getDelegate(); + final XMLReader lookedUp = ((SecureXMLReader) SecureSAXParserFactory.newNSInstance().newSAXParser().getXMLReader()).getDelegate(); assertEquals(lookedUp.getClass(), pluggable.getClass()); if (xercesOnClasspath()) { // The two families genuinely differ only where a third-party parser wins the lookup (the test-jdk-xerces execution). diff --git a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java index 3c5b69a..9536ef4 100644 --- a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java +++ b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java @@ -75,7 +75,7 @@ class ShadingFootprintTest { "SecureSAXParserFactory$1", "SecureSAXParserFactory$HardeningExpatXMLReader", "SecureSAXParserFactory$Wrapper", - "HardeningXMLReader", + "SecureXMLReader", "MethodHandleFactory"); // @formatter:on @@ -116,7 +116,7 @@ class ShadingFootprintTest { "SecureTransformerFactory$Wrapper", "SecureTransformerHandler", "SecureXMLFilter", - "HardeningXMLReader", + "SecureXMLReader", "SaxonProvider", "SaxonProvider$1", "SaxonProvider$HardenedConfiguration", @@ -138,7 +138,7 @@ class ShadingFootprintTest { "SecureSAXParserFactory$1", "SecureSAXParserFactory$HardeningExpatXMLReader", "SecureSAXParserFactory$Wrapper", - "HardeningXMLReader", + "SecureXMLReader", "HardeningXPath", "HardeningXPathExpression", "HardeningXPathFactory", @@ -166,7 +166,7 @@ class ShadingFootprintTest { "SecureSchemaFactory$Wrapper", "SecureValidator", "SecureValidatorHandler", - "HardeningXMLReader"); + "SecureXMLReader"); // @formatter:on /**
