This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
The following commit(s) were added to refs/heads/main by this push:
new 7e5ed98 Rename harden(...) methods to secure(...).
7e5ed98 is described below
commit 7e5ed9823782a8d8820024dada91e12568497273
Author: Gary Gregory <[email protected]>
AuthorDate: Fri Aug 28 13:32:18 2026 -0400
Rename harden(...) methods to secure(...).
---
.../commons/xml/FallbackIgnoreURIResolver.java | 2 +-
.../java/org/apache/commons/xml/SaxonProvider.java | 6 +++---
.../commons/xml/SecureDocumentBuilderFactory.java | 8 ++++----
.../org/apache/commons/xml/SecureSAXParser.java | 2 +-
.../apache/commons/xml/SecureSAXParserFactory.java | 22 ++++++++++----------
.../java/org/apache/commons/xml/SecureSchema.java | 2 +-
.../apache/commons/xml/SecureSchemaFactory.java | 24 +++++++++++-----------
.../org/apache/commons/xml/SecureTransformer.java | 4 ++--
.../commons/xml/SecureTransformerFactory.java | 24 +++++++++++-----------
.../org/apache/commons/xml/SecureValidator.java | 4 ++--
.../apache/commons/xml/SecureXMLInputFactory.java | 12 +++++------
.../org/apache/commons/xml/SecureXPathFactory.java | 12 +++++------
.../java/org/apache/commons/xml/package-info.java | 2 +-
.../org/apache/commons/xml/AttackTestSupport.java | 10 ++++-----
.../commons/xml/SaxonAlternateFactoryTest.java | 2 +-
.../apache/commons/xml/ShadingFootprintTest.java | 2 +-
.../xml/UnsupportedXmlImplementationTest.java | 4 ++--
.../java/org/apache/commons/xml/XIncludeTest.java | 6 +++---
18 files changed, 74 insertions(+), 74 deletions(-)
diff --git
a/src/main/java/org/apache/commons/xml/FallbackIgnoreURIResolver.java
b/src/main/java/org/apache/commons/xml/FallbackIgnoreURIResolver.java
index 26bdd92..c9a5ca5 100644
--- a/src/main/java/org/apache/commons/xml/FallbackIgnoreURIResolver.java
+++ b/src/main/java/org/apache/commons/xml/FallbackIgnoreURIResolver.java
@@ -125,7 +125,7 @@ public Source resolve(final String href, final String base)
throws TransformerEx
final Source resolved = delegate != null ? delegate.resolve(href,
base) : null;
if (resolved != null) {
// The implementation parses the opted-in handle with an internal
reader at its own defaults; the rewrite hands it a hardened reader instead.
- return SecureSAXParserFactory.harden(resolved,
overrideDefaultParser.getAsBoolean());
+ return SecureSAXParserFactory.secure(resolved,
overrideDefaultParser.getAsBoolean());
}
if (SecureException.throwOnUnresolved()) {
throw new TransformerException(SecureException.forbidden("uri",
null, null, href, base));
diff --git a/src/main/java/org/apache/commons/xml/SaxonProvider.java
b/src/main/java/org/apache/commons/xml/SaxonProvider.java
index 332ad41..4678955 100644
--- a/src/main/java/org/apache/commons/xml/SaxonProvider.java
+++ b/src/main/java/org/apache/commons/xml/SaxonProvider.java
@@ -37,7 +37,7 @@
import net.sf.saxon.xpath.XPathFactoryImpl;
/**
- * Hardening recipes for Saxon-HE ({@code net.sf.saxon:Saxon-HE}).
+ * Securing recipes for Saxon-HE ({@code net.sf.saxon:Saxon-HE}).
*
* <p>Saxon supplies {@link TransformerFactory} and {@link XPathFactory}
implementations; it does not ship a DOM, SAX, StAX or Schema factory of its
own.</p>
*/
@@ -52,7 +52,7 @@ final class SaxonProvider {
*
* <ol>
* <li><b>SAX layer.</b> {@link #makeParser} hands every {@link
XMLReader} Saxon would otherwise use through
- * {@link SecureSAXParserFactory#harden(XMLReader)}, which routes it to
the matching bundled hardening recipe. External DTDs, entities and XInclude
+ * {@link SecureSAXParserFactory#secure(XMLReader)}, which routes it to
the matching bundled hardening recipe. External DTDs, entities and XInclude
* resolve to empty content at parse time.</li>
* <li><b>Collection layer.</b> {@code fn:collection} bypasses the
resource resolver and fetches directly, so an empty {@link CollectionFinder}
supplies its
* ignore outcome instead.</li>
@@ -87,7 +87,7 @@ private HardenedConfiguration() {
@Override
public XMLReader makeParser(final String className) throws
TransformerFactoryConfigurationError {
try {
- return
SecureSAXParserFactory.harden(super.makeParser(className));
+ return
SecureSAXParserFactory.secure(super.makeParser(className));
} catch (final SecureException e) {
throw new TransformerFactoryConfigurationError(e);
}
diff --git
a/src/main/java/org/apache/commons/xml/SecureDocumentBuilderFactory.java
b/src/main/java/org/apache/commons/xml/SecureDocumentBuilderFactory.java
index 9c2b6b6..a5742bd 100644
--- a/src/main/java/org/apache/commons/xml/SecureDocumentBuilderFactory.java
+++ b/src/main/java/org/apache/commons/xml/SecureDocumentBuilderFactory.java
@@ -77,7 +77,7 @@ public final class SecureDocumentBuilderFactory {
* @return A new hardened factory or the original factory, as-is, if it is
a known Android factory.
* @throws SecureException Thrown if a (non-Andoid) factory cannot support
the secure processing feature {@link XMLConstants#FEATURE_SECURE_PROCESSING}.
*/
- static DocumentBuilderFactory harden(final DocumentBuilderFactory factory)
{
+ static DocumentBuilderFactory secure(final DocumentBuilderFactory factory)
{
// Android exposes no FSP, ACCESS_EXTERNAL_* or attribute API, and
KXmlParser drops user-defined entities; nothing to apply.
if
(ANDROID_DOCUMENT_BUILDER_FACTORY.equals(factory.getClass().getName())) {
return factory;
@@ -124,7 +124,7 @@ public static DocumentBuilderFactory newDefaultInstance() {
// Unreachable: the looked-up method declares no other
exceptions.
throw new IllegalStateException(e);
}
- return harden(factory);
+ return secure(factory);
}
// Java 8: the method does not exist; instantiate the JDK's built-in
default by its class name instead. Where that class does not exist either (for
// example Android), the lookup miss surfaces as the factory's own
FactoryConfigurationError, like any newInstance miss.
@@ -155,7 +155,7 @@ public static DocumentBuilderFactory newDefaultNSInstance()
{
* implementation is not available or
cannot be instantiated.
*/
public static DocumentBuilderFactory newInstance() {
- return harden(DocumentBuilderFactory.newInstance());
+ return secure(DocumentBuilderFactory.newInstance());
}
/**
@@ -170,7 +170,7 @@ public static DocumentBuilderFactory newInstance() {
* @throws FactoryConfigurationError Thrown if {@code factoryClassName} is
{@code null} or the factory class cannot be loaded or instantiated.
*/
public static DocumentBuilderFactory newInstance(final String
factoryClassName, final ClassLoader classLoader) {
- return harden(DocumentBuilderFactory.newInstance(factoryClassName,
classLoader));
+ return secure(DocumentBuilderFactory.newInstance(factoryClassName,
classLoader));
}
/**
diff --git a/src/main/java/org/apache/commons/xml/SecureSAXParser.java
b/src/main/java/org/apache/commons/xml/SecureSAXParser.java
index 3bde1b2..663b844 100644
--- a/src/main/java/org/apache/commons/xml/SecureSAXParser.java
+++ b/src/main/java/org/apache/commons/xml/SecureSAXParser.java
@@ -81,7 +81,7 @@ public Schema getSchema() {
@Override
public XMLReader getXMLReader() throws SAXException {
if (hardenedReader == null) {
- hardenedReader =
SecureSAXParserFactory.harden(delegate.getXMLReader());
+ hardenedReader =
SecureSAXParserFactory.secure(delegate.getXMLReader());
}
return hardenedReader;
}
diff --git a/src/main/java/org/apache/commons/xml/SecureSAXParserFactory.java
b/src/main/java/org/apache/commons/xml/SecureSAXParserFactory.java
index 1c53b4f..518c868 100644
--- a/src/main/java/org/apache/commons/xml/SecureSAXParserFactory.java
+++ b/src/main/java/org/apache/commons/xml/SecureSAXParserFactory.java
@@ -80,7 +80,7 @@ public final class SecureSAXParserFactory {
*
* <p>Rather than branching on the implementation class, this method
probes what the parser supports and adapts. Because
* {@link SAXParserFactory} exposes only a feature API and no property
API, the per-parse configuration runs on each {@link XMLReader} the factory
produces,
- * funnelled through the nested wrapper into {@link
#harden(XMLReader)}:</p>
+ * funnelled through the nested wrapper into {@link
#secure(XMLReader)}:</p>
* <ul>
* <li><strong>Android</strong> (Harmony / Expat): {@link
XMLConstants#FEATURE_SECURE_PROCESSING FSP} and the JAXP 1.5 {@code
ACCESS_EXTERNAL_*} properties
* are not recognized, and libexpat enforces its own Billion
Laughs check, so neither is applied. Two fixups are still needed: an ignore-all
resolver
@@ -98,12 +98,12 @@ public final class SecureSAXParserFactory {
* @param factory the factory to harden; never {@code null}.
* @return a hardened factory.
*/
- static SAXParserFactory harden(final SAXParserFactory factory) {
+ static SAXParserFactory secure(final SAXParserFactory factory) {
// Required: enables the implementation's security manager, which
carries the limits. Android's Expat rejects FSP, so it is skipped there.
if (!ANDROID_SAX_PARSER_FACTORY.equals(factory.getClass().getName())) {
setFeature(factory, XMLConstants.FEATURE_SECURE_PROCESSING, true);
}
- // The per-parse hardening (limits, entity blocking, Android fixups)
lives in harden(XMLReader) because SAXParserFactory has no property API.
+ // The per-parse hardening (limits, entity blocking, Android fixups)
lives in secure(XMLReader) because SAXParserFactory has no property API.
return new Wrapper(factory);
}
@@ -121,7 +121,7 @@ static SAXParserFactory harden(final SAXParserFactory
factory) {
* @throws FactoryConfigurationError Thrown from a factory in case
of a {@link java.util.ServiceConfigurationError service
* configuration error} or if
the implementation is not available or cannot be instantiated.
*/
- static Source harden(final Source source, final boolean
overrideDefaultParser) throws TransformerConfigurationException {
+ static Source secure(final Source source, final boolean
overrideDefaultParser) throws TransformerConfigurationException {
if (source instanceof StreamSource || source instanceof SAXSource &&
((SAXSource) source).getXMLReader() == null) {
final InputSource inputSource =
SAXSource.sourceToInputSource(source);
return inputSource == null ? source : new
SAXSource(newHardenedReader(overrideDefaultParser), inputSource);
@@ -130,15 +130,15 @@ static Source harden(final Source source, final boolean
overrideDefaultParser) t
}
/**
- * Hardens an existing {@link XMLReader}.
+ * Secures an existing {@link XMLReader}.
*
* @param reader The reader to harden; never {@code null}.
* @return A hardened reader.
* @throws IllegalStateException if a required hardening setting cannot be
applied to the underlying implementation.
*/
- static XMLReader harden(final XMLReader reader) {
+ static XMLReader secure(final XMLReader reader) {
if (reader instanceof SecureXMLReader) {
- // Already hardened (for example, a reader from a hardened factory
passed back through harden(XMLReader)); the floor is already in place.
+ // Already hardened (for example, a reader from a hardened factory
passed back through secure(XMLReader)); the floor is already in place.
return reader;
}
if (ANDROID_EXPAT_READER.equals(reader.getClass().getName())) {
@@ -189,7 +189,7 @@ public static SAXParserFactory newDefaultInstance() {
// Unreachable: the looked-up method declares no other
exceptions.
throw new IllegalStateException(e);
}
- return harden(factory);
+ return secure(factory);
}
// Java 8: the method does not exist; instantiate the JDK's built-in
default by its class name instead. Where that class does not exist either (for
// example Android), the lookup miss surfaces as the factory's own
FactoryConfigurationError, like any newInstance miss.
@@ -236,7 +236,7 @@ static XMLReader newHardenedReader(final boolean
overrideDefaultParser) throws T
* error} or if the implementation is
not available or cannot be instantiated.
*/
public static SAXParserFactory newInstance() {
- return harden(SAXParserFactory.newInstance());
+ return secure(SAXParserFactory.newInstance());
}
/**
@@ -249,7 +249,7 @@ public static SAXParserFactory newInstance() {
* @throws FactoryConfigurationError Thrown if {@code factoryClassName} is
{@code null} or the factory class cannot be loaded or instantiated.
*/
public static SAXParserFactory newInstance(final String factoryClassName,
final ClassLoader classLoader) {
- return harden(SAXParserFactory.newInstance(factoryClassName,
classLoader));
+ return secure(SAXParserFactory.newInstance(factoryClassName,
classLoader));
}
/**
@@ -343,7 +343,7 @@ public void setFeature(final String name, final boolean
value) throws SAXNotReco
}
/**
- * Universal SAX factory wrapper that funnels every produced parser
through {@link SecureSAXParserFactory#harden(XMLReader)}.
+ * Universal SAX factory wrapper that funnels every produced parser
through {@link SecureSAXParserFactory#secure(XMLReader)}.
* <p>
* {@link SAXParserFactory} exposes only a feature API and no property
API, so the per-parse hardening (limits, entity blocking,
implementation-specific fixups)
* has to run on each {@link XMLReader} the factory produces. This wrapper
returns a {@link SecureSAXParser}, which applies that hardening lazily to both
the
diff --git a/src/main/java/org/apache/commons/xml/SecureSchema.java
b/src/main/java/org/apache/commons/xml/SecureSchema.java
index 0815d18..c5fe81a 100644
--- a/src/main/java/org/apache/commons/xml/SecureSchema.java
+++ b/src/main/java/org/apache/commons/xml/SecureSchema.java
@@ -25,7 +25,7 @@
/**
* {@link Schema} wrapper that hardens every {@link Validator} and {@link
ValidatorHandler} the inner Schema produces: each {@link Validator} is wrapped
in
- * {@link SecureValidator} (which rewrites the Source through {@link
SecureSAXParserFactory#harden(javax.xml.transform.Source, boolean)} and
installs the resolver
+ * {@link SecureValidator} (which rewrites the Source through {@link
SecureSAXParserFactory#secure(javax.xml.transform.Source, boolean)} and
installs the resolver
* floor), and each {@link ValidatorHandler} is wrapped in a {@link
SecureValidatorHandler} that keeps the same ignore-all resolver floor so
* {@code xsi:schemaLocation} is not resolved during SAX-driven validation.
*/
diff --git a/src/main/java/org/apache/commons/xml/SecureSchemaFactory.java
b/src/main/java/org/apache/commons/xml/SecureSchemaFactory.java
index 924e93e..38fe24e 100644
--- a/src/main/java/org/apache/commons/xml/SecureSchemaFactory.java
+++ b/src/main/java/org/apache/commons/xml/SecureSchemaFactory.java
@@ -65,17 +65,17 @@ public final class SecureSchemaFactory {
MethodType.methodType(SchemaFactory.class));
/**
- * Hardening for any {@link SchemaFactory} on the classpath.
+ * Secures a {@link SchemaFactory}.
*
* <p>Unlike the other factory types there is no per-implementation
branching and no feature or limit configuration on the factory itself: schema
compilation
* and validation reach external resources only through the resolver hook,
so wrapping the factory with a non-removable ignore-all resolver floor is
enough on
* every implementation. The reader used to parse schema and instance
documents is hardened separately, through
- * {@link SecureSAXParserFactory#harden(javax.xml.transform.Source,
boolean)}.</p>
+ * {@link SecureSAXParserFactory#secure(javax.xml.transform.Source,
boolean)}.</p>
*
* @param factory the factory to harden; never {@code null}.
* @return a hardened factory.
*/
- static SchemaFactory harden(final SchemaFactory factory) {
+ static SchemaFactory secure(final SchemaFactory factory) {
return new Wrapper(factory);
}
@@ -102,7 +102,7 @@ public static SchemaFactory newDefaultInstance() {
// Unreachable: the looked-up method declares no other
exceptions.
throw new IllegalStateException(e);
}
- return harden(factory);
+ return secure(factory);
}
// Java 8: the method does not exist; instantiate the JDK's built-in
default by its class name instead. Where that class does not exist either (for
// example Android), the lookup miss surfaces as
IllegalArgumentException, the error SchemaFactory.newInstance(String, String,
ClassLoader) defines.
@@ -119,7 +119,7 @@ public static SchemaFactory newDefaultInstance() {
* @throws SchemaFactoryConfigurationError Thrown if a configuration error
is encountered.
*/
public static SchemaFactory newInstance(final String schemaLanguage) {
- return harden(SchemaFactory.newInstance(schemaLanguage));
+ return secure(SchemaFactory.newInstance(schemaLanguage));
}
/**
@@ -134,7 +134,7 @@ public static SchemaFactory newInstance(final String
schemaLanguage) {
* @throws NullPointerException Thrown if {@code schemaLanguage} is
{@code null}.
*/
public static SchemaFactory newInstance(final String schemaLanguage, final
String factoryClassName, final ClassLoader classLoader) {
- return harden(SchemaFactory.newInstance(schemaLanguage,
factoryClassName, classLoader));
+ return secure(SchemaFactory.newInstance(schemaLanguage,
factoryClassName, classLoader));
}
private SecureSchemaFactory() {
@@ -150,14 +150,14 @@ private SecureSchemaFactory() {
* <ol>
* <li>{@link SecureSchemaFactory} installs an ignore-all {@link
FallbackIgnoreLSResourceResolver} floor on the factory (blocking
* {@code xs:import}/{@code xs:include}/{@code xs:redefine} at
compile time) and rewrites the Source on every {@code newSchema(Source[])}
entry point
- * through {@link SecureSAXParserFactory#harden(Source,
boolean)}.</li>
+ * through {@link SecureSAXParserFactory#secure(Source,
boolean)}.</li>
* <li>{@link SecureSchema} wraps every Validator/ValidatorHandler the
inner Schema produces and re-installs the floor on each (blocking
* {@code xsi:schemaLocation} at validation time), since neither the
JDK nor Xerces reliably propagates it through {@code Schema}.</li>
* <li>{@link SecureValidator} rewrites the Source on every {@link
Validator#validate(Source)} call.</li>
* </ol>
*
* <p>
- * The hardened reader supplied by {@link
SecureSAXParserFactory#harden(Source, boolean)} already carries {@code
FEATURE_SECURE_PROCESSING} and the processing limits, so a
+ * The hardened reader supplied by {@link
SecureSAXParserFactory#secure(Source, boolean)} already carries {@code
FEATURE_SECURE_PROCESSING} and the processing limits, so a
* DOCTYPE, external entity or Billion Laughs payload in the schema or
instance document is bounded there rather than on this factory. The JAXP 1.5
* {@code ACCESS_EXTERNAL_*} properties are deliberately not set: the
resolver floor already blocks the same fetches on every implementation, and the
JDK 8
* {@code SchemaFactory} has a bug whereby those properties keep blocking
even when a caller's own resolver would grant the access. The floor is a
non-removable
@@ -170,7 +170,7 @@ private SecureSchemaFactory() {
private static final class Wrapper extends SchemaFactory {
/**
- * Hardens every schema source through {@link
SecureSAXParserFactory#harden(Source, boolean)}.
+ * Secures every schema source through {@link
SecureSAXParserFactory#secure(Source, boolean)}.
*
* @param schemas the schema sources to harden; must not be {@code
null}.
* @return a new array of hardened sources.
@@ -178,12 +178,12 @@ private static final class Wrapper extends SchemaFactory {
* @throws FactoryConfigurationError Thrown from a factory in case of
a {@link java.util.ServiceConfigurationError service
* configuration error} or if the
implementation is not available or cannot be instantiated.
*/
- private Source[] harden(final Source[] schemas) throws SAXException {
+ private Source[] secure(final Source[] schemas) throws SAXException {
final Source[] hardened = new Source[schemas.length];
final boolean overrideDefaultParser = overrideDefaultParser();
try {
for (int i = 0; i < schemas.length; i++) {
- hardened[i] = SecureSAXParserFactory.harden(schemas[i],
overrideDefaultParser);
+ hardened[i] = SecureSAXParserFactory.secure(schemas[i],
overrideDefaultParser);
}
} catch (final TransformerConfigurationException e) {
throw new SAXException("Failed to harden schema source", e);
@@ -246,7 +246,7 @@ public Schema newSchema() throws SAXException {
*/
@Override
public Schema newSchema(final Source[] schemas) throws SAXException {
- return new SecureSchema(delegate.newSchema(harden(schemas)),
overrideDefaultParser());
+ return new SecureSchema(delegate.newSchema(secure(schemas)),
overrideDefaultParser());
}
/**
diff --git a/src/main/java/org/apache/commons/xml/SecureTransformer.java
b/src/main/java/org/apache/commons/xml/SecureTransformer.java
index 255637d..112b6ad 100644
--- a/src/main/java/org/apache/commons/xml/SecureTransformer.java
+++ b/src/main/java/org/apache/commons/xml/SecureTransformer.java
@@ -32,7 +32,7 @@
/**
* {@link Transformer} wrapper that rewrites the Source on every {@link
Transformer#transform(Source, Result)} call through
- * {@link SecureSAXParserFactory#harden(Source, boolean)} before delegating,
and keeps an ignore-all {@link URIResolver} floor so runtime {@code document()}
calls a
+ * {@link SecureSAXParserFactory#secure(Source, boolean)} before delegating,
and keeps an ignore-all {@link URIResolver} floor so runtime {@code document()}
calls a
* caller does not resolve return empty rather than being fetched.
* <p>
* The floor is installed on the delegate transformer at construction, seeded
with the factory's compile-time resolver; {@link #setURIResolver(URIResolver)}
@@ -145,7 +145,7 @@ public void setURIResolver(final URIResolver resolver) {
@Override
public void transform(final Source xmlSource, final Result outputTarget)
throws TransformerException {
try {
- delegate.transform(SecureSAXParserFactory.harden(xmlSource,
overrideDefaultParser), outputTarget);
+ delegate.transform(SecureSAXParserFactory.secure(xmlSource,
overrideDefaultParser), outputTarget);
} catch (final TransformerConfigurationException e) {
throw new TransformerException(e);
}
diff --git a/src/main/java/org/apache/commons/xml/SecureTransformerFactory.java
b/src/main/java/org/apache/commons/xml/SecureTransformerFactory.java
index 2d1b751..8746898 100644
--- a/src/main/java/org/apache/commons/xml/SecureTransformerFactory.java
+++ b/src/main/java/org/apache/commons/xml/SecureTransformerFactory.java
@@ -105,7 +105,7 @@ public final class SecureTransformerFactory {
* @param factory the factory to harden; never {@code null}.
* @return a hardened factory.
*/
- static TransformerFactory harden(final TransformerFactory factory) {
+ static TransformerFactory secure(final TransformerFactory factory) {
// Required: enables secure processing (XSLTC runtime limits; Xalan's
extension-function block).
setFeature(factory, XMLConstants.FEATURE_SECURE_PROCESSING, true);
if (SaxonProvider.isSaxon(factory.getClass())) {
@@ -142,7 +142,7 @@ public static TransformerFactory newDefaultInstance() {
// Unreachable: the looked-up method declares no other
exceptions.
throw new IllegalStateException(e);
}
- return harden(factory);
+ return secure(factory);
}
// Java 8: the method does not exist; instantiate the JDK's built-in
default by its class name instead. Where that class does not exist either (for
// example Android), the lookup miss surfaces as
TransformerFactoryConfigurationError, like any newInstance miss.
@@ -156,7 +156,7 @@ public static TransformerFactory newDefaultInstance() {
* @throws IllegalStateException if a required hardening setting cannot be
applied to the underlying implementation.
*/
public static TransformerFactory newInstance() {
- return harden(TransformerFactory.newInstance());
+ return secure(TransformerFactory.newInstance());
}
/**
@@ -169,7 +169,7 @@ public static TransformerFactory newInstance() {
* @throws TransformerFactoryConfigurationError Thrown if {@code
factoryClassName} is {@code null} or the factory class cannot be loaded or
instantiated.
*/
public static TransformerFactory newInstance(final String
factoryClassName, final ClassLoader classLoader) {
- return harden(TransformerFactory.newInstance(factoryClassName,
classLoader));
+ return secure(TransformerFactory.newInstance(factoryClassName,
classLoader));
}
private static void setFeature(final TransformerFactory factory, final
String feature, final boolean value) {
@@ -185,7 +185,7 @@ private SecureTransformerFactory() {
}
/**
- * {@link TransformerFactory} wrapper that rewrites every Source-taking
entry point through {@link SecureSAXParserFactory#harden(Source, boolean)}
before
+ * {@link TransformerFactory} wrapper that rewrites every Source-taking
entry point through {@link SecureSAXParserFactory#secure(Source, boolean)}
before
* delegating.
*
* <p>Used by providers whose underlying TrAX implementation pulls a new
{@code SAXParserFactory.newInstance()} for any Source that is not already a
@@ -220,10 +220,10 @@ private static final class Wrapper extends
SAXTransformerFactory {
/**
* Parses a reader-less source into a DOM through a hardened,
namespace-aware {@link javax.xml.parsers.DocumentBuilder} and returns a {@link
DOMSource}
* carrying its system id, so the consumer walks the tree instead of
provisioning its own reader. Any other source is left to
- * {@link SecureSAXParserFactory#harden(Source, boolean)}.
+ * {@link SecureSAXParserFactory#secure(Source, boolean)}.
*
* @param source The source to scan for an associated stylesheet.
- * @return A {@link DOMSource} for a reader-less source, otherwise the
result of {@link SecureSAXParserFactory#harden(Source, boolean)}.
+ * @return A {@link DOMSource} for a reader-less source, otherwise the
result of {@link SecureSAXParserFactory#secure(Source, boolean)}.
* @throws TransformerConfigurationException if the source cannot be
parsed.
* @throws FactoryConfigurationError Thrown from a factory in case of
a {@link java.util.ServiceConfigurationError service
* configuration error} or if the
implementation is not available or cannot be instantiated.
@@ -242,7 +242,7 @@ private Source hardenSourceToDom(final Source source)
throws TransformerConfigur
}
}
}
- return SecureSAXParserFactory.harden(source,
overrideDefaultParser());
+ return SecureSAXParserFactory.secure(source,
overrideDefaultParser());
}
/**
@@ -326,7 +326,7 @@ private Wrapper(final SAXTransformerFactory delegate, final
Supplier<Source> emp
public Source getAssociatedStylesheet(final Source source, final
String media, final String title, final String charset)
throws TransformerConfigurationException {
// Xalan's getAssociatedStylesheet drops a SAXSource's reader and
self-provisions its own to scan for xml-stylesheet PIs (XALANJ-2849).
- final Source hardened = isXalan(delegate) ?
hardenSourceToDom(source) : SecureSAXParserFactory.harden(source,
overrideDefaultParser());
+ final Source hardened = isXalan(delegate) ?
hardenSourceToDom(source) : SecureSAXParserFactory.secure(source,
overrideDefaultParser());
return delegate.getAssociatedStylesheet(hardened, media, title,
charset);
}
@@ -362,7 +362,7 @@ private TransformerHandler hardenHandler(final
TransformerHandler handler) {
*/
@Override
public Templates newTemplates(final Source source) throws
TransformerConfigurationException {
- final Templates templates =
delegate.newTemplates(SecureSAXParserFactory.harden(source,
overrideDefaultParser()));
+ final Templates templates =
delegate.newTemplates(SecureSAXParserFactory.secure(source,
overrideDefaultParser()));
return templates == null ? null : new SecureTemplates(templates,
getURIResolver(), emptySource, overrideDefaultParser());
}
@@ -387,7 +387,7 @@ public Transformer newTransformer() throws
TransformerConfigurationException {
*/
@Override
public Transformer newTransformer(final Source source) throws
TransformerConfigurationException {
- final Transformer transformer =
delegate.newTransformer(SecureSAXParserFactory.harden(source,
overrideDefaultParser()));
+ final Transformer transformer =
delegate.newTransformer(SecureSAXParserFactory.secure(source,
overrideDefaultParser()));
return transformer == null ? null : new
SecureTransformer(transformer, getURIResolver(), emptySource,
overrideDefaultParser());
}
@@ -404,7 +404,7 @@ public TransformerHandler newTransformerHandler() throws
TransformerConfiguratio
*/
@Override
public TransformerHandler newTransformerHandler(final Source source)
throws TransformerConfigurationException {
- return
hardenHandler(delegate.newTransformerHandler(SecureSAXParserFactory.harden(source,
overrideDefaultParser())));
+ return
hardenHandler(delegate.newTransformerHandler(SecureSAXParserFactory.secure(source,
overrideDefaultParser())));
}
@Override
diff --git a/src/main/java/org/apache/commons/xml/SecureValidator.java
b/src/main/java/org/apache/commons/xml/SecureValidator.java
index 41f9edb..c67e541 100644
--- a/src/main/java/org/apache/commons/xml/SecureValidator.java
+++ b/src/main/java/org/apache/commons/xml/SecureValidator.java
@@ -34,7 +34,7 @@
/**
* {@link Validator} wrapper that rewrites the Source on every {@link
Validator#validate(Source)} and {@link Validator#validate(Source, Result)} call
through
- * {@link SecureSAXParserFactory#harden(Source, boolean)} before delegating,
and keeps an ignore-all {@link LSResourceResolver} floor so {@code
xsi:schemaLocation} is not resolved at
+ * {@link SecureSAXParserFactory#secure(Source, boolean)} before delegating,
and keeps an ignore-all {@link LSResourceResolver} floor so {@code
xsi:schemaLocation} is not resolved at
* validation time. {@link #reset()} re-establishes the bare ignore-all floor,
matching the just-constructed state.
*/
final class SecureValidator extends Validator {
@@ -121,7 +121,7 @@ public void setResourceResolver(final LSResourceResolver
resourceResolver) {
@Override
public void validate(final Source source, final Result result) throws
SAXException, IOException {
try {
- delegate.validate(SecureSAXParserFactory.harden(source,
overrideDefaultParser), result);
+ delegate.validate(SecureSAXParserFactory.secure(source,
overrideDefaultParser), result);
} catch (final TransformerConfigurationException e) {
throw new SAXException("Failed to harden source for validation",
e);
}
diff --git a/src/main/java/org/apache/commons/xml/SecureXMLInputFactory.java
b/src/main/java/org/apache/commons/xml/SecureXMLInputFactory.java
index ba1bea3..95527e0 100644
--- a/src/main/java/org/apache/commons/xml/SecureXMLInputFactory.java
+++ b/src/main/java/org/apache/commons/xml/SecureXMLInputFactory.java
@@ -71,7 +71,7 @@ public final class SecureXMLInputFactory {
* @param factory the factory to harden; never {@code null}.
* @return a hardened factory.
*/
- static XMLInputFactory harden(final XMLInputFactory factory) {
+ static XMLInputFactory secure(final XMLInputFactory factory) {
// The wrapper installs the non-removable ignore-all resolver floor
that resolves every external DTD and entity to empty content.
return new Wrapper(factory);
}
@@ -99,11 +99,11 @@ public static XMLInputFactory newDefaultFactory() {
// Unreachable: the looked-up method declares no other
exceptions.
throw new IllegalStateException(e);
}
- return harden(factory);
+ return secure(factory);
}
try {
// Java 8: the method does not exist, and XMLInputFactory has no
class-name-taking lookup; instantiate the JDK's built-in default directly.
- return harden((XMLInputFactory)
Class.forName(JDK_XML_INPUT_FACTORY).getConstructor().newInstance());
+ return secure((XMLInputFactory)
Class.forName(JDK_XML_INPUT_FACTORY).getConstructor().newInstance());
} catch (final ReflectiveOperationException e) {
// Where the class does not exist either (for example Android),
report the miss like any StAX factory lookup: with FactoryConfigurationError.
throw new FactoryConfigurationError(e, "Neither
XMLInputFactory.newDefaultFactory() nor " + JDK_XML_INPUT_FACTORY + " is
available");
@@ -119,7 +119,7 @@ public static XMLInputFactory newDefaultFactory() {
*/
public static XMLInputFactory newFactory() {
// XMLInputFactory.newInstance, not newFactory: the same specified
lookup, but Android's StAX API predates newFactory.
- return harden(XMLInputFactory.newInstance());
+ return secure(XMLInputFactory.newInstance());
}
/**
@@ -133,7 +133,7 @@ public static XMLInputFactory newFactory() {
* @throws NullPointerException Thrown if {@code factoryId} is {@code
null}.
*/
public static XMLInputFactory newFactory(final String factoryId, final
ClassLoader classLoader) {
- return harden(XMLInputFactory.newFactory(factoryId, classLoader));
+ return secure(XMLInputFactory.newFactory(factoryId, classLoader));
}
/**
@@ -144,7 +144,7 @@ public static XMLInputFactory newFactory(final String
factoryId, final ClassLoad
* @throws FactoryConfigurationError Thrown if an instance of this factory
cannot be loaded.
*/
public static XMLInputFactory newInstance() {
- return harden(XMLInputFactory.newInstance());
+ return secure(XMLInputFactory.newInstance());
}
private SecureXMLInputFactory() {
diff --git a/src/main/java/org/apache/commons/xml/SecureXPathFactory.java
b/src/main/java/org/apache/commons/xml/SecureXPathFactory.java
index 52f431b..d1bf0a5 100644
--- a/src/main/java/org/apache/commons/xml/SecureXPathFactory.java
+++ b/src/main/java/org/apache/commons/xml/SecureXPathFactory.java
@@ -63,7 +63,7 @@ public final class SecureXPathFactory {
* <li><strong>Saxon</strong> ({@code net.sf.saxon}): recognized by
package prefix and handed to {@link SaxonProvider#configure(XPathFactory)}, so
any public
* subclass routes to the same recipe as the registered factory.
Its URI-fetching
* functions and reflection-based extension calls are reachable
only through a locked-down Saxon {@code Configuration}, not the standard JAXP
knobs; this
- * is the XPath counterpart of the Saxon exception in {@link
SecureTransformerFactory#harden(javax.xml.transform.TransformerFactory)}, kept
as a
+ * is the XPath counterpart of the Saxon exception in {@link
SecureTransformerFactory#secure(javax.xml.transform.TransformerFactory)}, kept
as a
* documented package-prefix exception because the required
hardening surface is reachable only through a vendor API.</li>
* <li><strong>FSP</strong> ({@link
javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING}): required. It is the only
knob both the stock JDK and Xalan XPath
* engines expose, and switches on their secure-processing limits.
{@link XPathFactory} has no attribute API for finer control.</li>
@@ -76,7 +76,7 @@ public final class SecureXPathFactory {
* @return A new hardened factory or the original factory, hardened, if it
is a known Saxon factory.
* @throws SecureException Thrown if this {@link XPathFactory} or the
{@code XPath}s it creates cannot support this feature.
*/
- static XPathFactory harden(final XPathFactory factory) {
+ static XPathFactory secure(final XPathFactory factory) {
if (SaxonProvider.isSaxon(factory.getClass())) {
// Saxon: only a locked-down Configuration can close its
URI-fetching functions and extension-function surface.
return SaxonProvider.configure(factory);
@@ -110,7 +110,7 @@ public static XPathFactory newDefaultInstance() {
// Unreachable: the looked-up method declares no other
exceptions.
throw new IllegalStateException(e);
}
- return harden(factory);
+ return secure(factory);
}
try {
// Java 8: the method does not exist; instantiate the JDK's
built-in default by its class name instead.
@@ -130,7 +130,7 @@ public static XPathFactory newDefaultInstance() {
* @throws RuntimeException Thrown if there is a failure in creating
an {@link XPathFactory} for the default object model.
*/
public static XPathFactory newInstance() {
- return harden(XPathFactory.newInstance());
+ return secure(XPathFactory.newInstance());
}
/**
@@ -144,7 +144,7 @@ public static XPathFactory newInstance() {
* @throws IllegalArgumentException Thrown if {@code uri} is
empty.
*/
public static XPathFactory newInstance(final String uri) throws
XPathFactoryConfigurationException {
- return harden(XPathFactory.newInstance(uri));
+ return secure(XPathFactory.newInstance(uri));
}
/**
@@ -162,7 +162,7 @@ public static XPathFactory newInstance(final String uri)
throws XPathFactoryConf
*/
public static XPathFactory newInstance(final String uri, final String
factoryClassName, final ClassLoader classLoader)
throws XPathFactoryConfigurationException {
- return harden(XPathFactory.newInstance(uri, factoryClassName,
classLoader));
+ return secure(XPathFactory.newInstance(uri, factoryClassName,
classLoader));
}
/**
diff --git a/src/main/java/org/apache/commons/xml/package-info.java
b/src/main/java/org/apache/commons/xml/package-info.java
index e61d4a0..6b122c0 100644
--- a/src/main/java/org/apache/commons/xml/package-info.java
+++ b/src/main/java/org/apache/commons/xml/package-info.java
@@ -38,7 +38,7 @@
* <p>
* Whichever parser is selected, it is hardened.
* </p>
- * <h2>Hardening guarantees</h2>
+ * <h2>Security Guarantees</h2>
* <p>
* Every factory returned by makes the same three guarantees, regardless of
which JAXP implementation is on the classpath:
* </p>
diff --git a/src/test/java/org/apache/commons/xml/AttackTestSupport.java
b/src/test/java/org/apache/commons/xml/AttackTestSupport.java
index 3547f7a..4c7a622 100644
--- a/src/test/java/org/apache/commons/xml/AttackTestSupport.java
+++ b/src/test/java/org/apache/commons/xml/AttackTestSupport.java
@@ -691,7 +691,7 @@ static void assertValidatorValidates(final String xml) {
/**
* Asserts a hardened-in-place XMLReader parse of the payload throws.
*
- * <p>{@link XMLReader#parse(InputSource)} on a raw reader hardened via
{@link SecureSAXParserFactory#harden(XMLReader)}; only a thrown exception
passes.</p>
+ * <p>{@link XMLReader#parse(InputSource)} on a raw reader hardened via
{@link SecureSAXParserFactory#secure(XMLReader)}; only a thrown exception
passes.</p>
*/
static void assertXmlReaderBlocks(final String payload) {
assertParseFails(() -> consumeXmlReader(rawHardenedReader(), payload),
"XMLReader", SAXException.class);
@@ -707,7 +707,7 @@ static void assertXmlReaderBlocksOrDoesNotLeak(final String
payload) {
/**
* Asserts a hardened-in-place XMLReader parse completes without throwing
and without leaked content.
*
- * <p>{@link XMLReader#parse(InputSource)} on a raw reader hardened via
{@link SecureSAXParserFactory#harden(XMLReader)}; use this when the hardening
contract
+ * <p>{@link XMLReader#parse(InputSource)} on a raw reader hardened via
{@link SecureSAXParserFactory#secure(XMLReader)}; use this when the hardening
contract
* guarantees the parse succeeds but never resolves the external
resource.</p>
*/
static void assertXmlReaderDoesNotLeak(final String payload) {
@@ -717,7 +717,7 @@ static void assertXmlReaderDoesNotLeak(final String
payload) {
/**
* Asserts a hardened-in-place XMLReader parse succeeds.
*
- * <p>{@link XMLReader#parse(InputSource)} on a raw reader hardened via
{@link SecureSAXParserFactory#harden(XMLReader)}; positive control for
DOCTYPE-only
+ * <p>{@link XMLReader#parse(InputSource)} on a raw reader hardened via
{@link SecureSAXParserFactory#secure(XMLReader)}; positive control for
DOCTYPE-only
* payloads.</p>
*/
static void assertXmlReaderParses(final String payload) {
@@ -926,13 +926,13 @@ private static boolean probeDomResolvesInternalEntities()
{
}
}
- /** Builds a raw {@link XMLReader} from a deliberately permissive {@link
SAXParserFactory} and hardens it via {@link
SecureSAXParserFactory#harden(XMLReader)}. */
+ /** Builds a raw {@link XMLReader} from a deliberately permissive {@link
SAXParserFactory} and hardens it via {@link
SecureSAXParserFactory#secure(XMLReader)}. */
private static XMLReader rawHardenedReader() throws Exception {
final SAXParserFactory factory = SAXParserFactory.newInstance();
if (!IS_ANDROID) {
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false);
}
- return
SecureSAXParserFactory.harden(factory.newSAXParser().getXMLReader());
+ return
SecureSAXParserFactory.secure(factory.newSAXParser().getXMLReader());
}
/** Opens the named test resource as a {@link StreamSource} preserving its
system id, so relative includes/imports/redefines resolve normally. */
diff --git
a/src/test/java/org/apache/commons/xml/SaxonAlternateFactoryTest.java
b/src/test/java/org/apache/commons/xml/SaxonAlternateFactoryTest.java
index 03094f7..4b89c21 100644
--- a/src/test/java/org/apache/commons/xml/SaxonAlternateFactoryTest.java
+++ b/src/test/java/org/apache/commons/xml/SaxonAlternateFactoryTest.java
@@ -87,7 +87,7 @@ private static String transform(final TransformerFactory
factory) throws Transfo
void hardenedBasicFactoryDoesNotLeakCollection() {
assumeSaxonPresent();
try {
- final String result =
transform(SecureTransformerFactory.harden(basicSaxonFactory()));
+ final String result =
transform(SecureTransformerFactory.secure(basicSaxonFactory()));
assertFalse(result.contains(AttackTestSupport.LEAKED_MARKER),
"collection() leaked through the alternate Saxon factory:\n" + result);
} catch (final TransformerException blocked) {
// Throwing is an acceptable outcome since it also prevents
leaking the marker.
diff --git a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java
b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java
index 5e01c37..3db3e82 100644
--- a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java
+++ b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java
@@ -90,7 +90,7 @@ class ShadingFootprintTest {
// @formatter:on
/**
- * TrAX, XPath and schema re-harden their sub-parsers through {@link
SecureSAXParserFactory#harden(Source, boolean)}, so each builds on the full SAX
closure below;
+ * TrAX, XPath and schema re-harden their sub-parsers through {@link
SecureSAXParserFactory#secure(Source, boolean)}, so each builds on the full SAX
closure below;
* TrAX additionally parses the Xalan {@code getAssociatedStylesheet}
source and XPath its InputSource-taking evaluate calls through the DOM entry
point, so
* their closures carry that set too.
*/
diff --git
a/src/test/java/org/apache/commons/xml/UnsupportedXmlImplementationTest.java
b/src/test/java/org/apache/commons/xml/UnsupportedXmlImplementationTest.java
index 002c482..1f1ff95 100644
--- a/src/test/java/org/apache/commons/xml/UnsupportedXmlImplementationTest.java
+++ b/src/test/java/org/apache/commons/xml/UnsupportedXmlImplementationTest.java
@@ -93,7 +93,7 @@ public void setFeature(final String name, final boolean
value) throws SAXNotReco
void hardenRejectsUnsecurableFactory() {
final IllegalStateException thrown = assertThrows(
IllegalStateException.class,
- () -> SecureDocumentBuilderFactory.harden(new
FakeDocumentBuilderFactory()));
+ () -> SecureDocumentBuilderFactory.secure(new
FakeDocumentBuilderFactory()));
assertNotNull(thrown.getMessage());
assertTrue(thrown.getMessage().contains(FakeDocumentBuilderFactory.class.getName()),
"Exception message must name the unsupported class: " +
thrown.getMessage());
@@ -103,7 +103,7 @@ void hardenRejectsUnsecurableFactory() {
void hardenRejectsUnsecurableSaxFactory() {
final IllegalStateException thrown = assertThrows(
IllegalStateException.class,
- () -> SecureSAXParserFactory.harden(new
FakeSAXParserFactory()));
+ () -> SecureSAXParserFactory.secure(new
FakeSAXParserFactory()));
assertNotNull(thrown.getMessage());
assertTrue(thrown.getMessage().contains(FakeSAXParserFactory.class.getName()),
"Exception message must name the unsupported class: " +
thrown.getMessage());
diff --git a/src/test/java/org/apache/commons/xml/XIncludeTest.java
b/src/test/java/org/apache/commons/xml/XIncludeTest.java
index 3306c46..44ca989 100644
--- a/src/test/java/org/apache/commons/xml/XIncludeTest.java
+++ b/src/test/java/org/apache/commons/xml/XIncludeTest.java
@@ -341,7 +341,7 @@ void hardenReaderAllowListResolvesParseXml() throws
Exception {
final SAXParserFactory unhardenedFactory =
SAXParserFactory.newInstance();
unhardenedFactory.setNamespaceAware(true);
assumeXIncludeAware(unhardenedFactory);
- final XMLReader reader =
SecureSAXParserFactory.harden(unhardenedFactory.newSAXParser().getXMLReader());
+ final XMLReader reader =
SecureSAXParserFactory.secure(unhardenedFactory.newSAXParser().getXMLReader());
reader.setEntityResolver(new AllowListResolver());
final String captured = captureCharacters(reader, input);
assertEquals(RESOLVED_MARKER, captured.trim(),
@@ -356,7 +356,7 @@ void hardenReaderBlocksParseText() throws Exception {
final SAXParserFactory unhardenedFactory =
SAXParserFactory.newInstance();
unhardenedFactory.setNamespaceAware(true);
assumeXIncludeAware(unhardenedFactory);
- final XMLReader reader =
SecureSAXParserFactory.harden(unhardenedFactory.newSAXParser().getXMLReader());
+ final XMLReader reader =
SecureSAXParserFactory.secure(unhardenedFactory.newSAXParser().getXMLReader());
final String captured = captureCharacters(reader, input);
assertFalse(captured.contains(LEAKED_MARKER),
"hardenReader parse=text must resolve the include to empty,
not leak; got: " + captured);
@@ -371,7 +371,7 @@ void hardenReaderBlocksParseXml() throws Exception {
final SAXParserFactory unhardenedFactory =
SAXParserFactory.newInstance();
unhardenedFactory.setNamespaceAware(true);
assumeXIncludeAware(unhardenedFactory);
- final XMLReader reader =
SecureSAXParserFactory.harden(unhardenedFactory.newSAXParser().getXMLReader());
+ final XMLReader reader =
SecureSAXParserFactory.secure(unhardenedFactory.newSAXParser().getXMLReader());
assertThrows(SAXException.class, () -> reader.parse(input),
"hardenReader should block XInclude parse=xml on reader with
XInclude already enabled");
}
