This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 4cc0062b652970c4ca1ca12f353c8fe02cb9794e Author: Gary Gregory <[email protected]> AuthorDate: Fri Aug 28 17:31:07 2026 -0400 Javadoc: Use "secure" terminology. Same in exception message. --- RELEASE-NOTES.txt | 4 ++-- src/changes/changes.xml | 6 +++--- src/main/java/org/apache/commons/xml/SaxonProvider.java | 2 +- src/main/java/org/apache/commons/xml/SecureSchemaFactory.java | 2 +- src/main/java/org/apache/commons/xml/SecureTransformerFactory.java | 2 +- src/main/java/org/apache/commons/xml/SecureValidator.java | 2 +- src/site/markdown/index.md | 4 ++-- 7 files changed, 11 insertions(+), 11 deletions(-) diff --git a/RELEASE-NOTES.txt b/RELEASE-NOTES.txt index 040e37e..2e65496 100644 --- a/RELEASE-NOTES.txt +++ b/RELEASE-NOTES.txt @@ -32,7 +32,7 @@ New features * This is the first release of Apache Commons Secure XML. Thanks to Piotr P. Karwasz, Gary Gregory. * Add secure-by-default JAXP factory creation via org.apache.commons.xml, donated from the copernik-xml-factory project (https://github.com/copernik-eu/copernik-xml-factory) and covering the stock JDK, Android, Apache Xalan, Apache Xerces, Woodstox, and Saxon-HE. Thanks to Piotr P. Karwasz, Gary Gregory. * COMMONSXML-9: Install a non-removable resolver floor on every resolver channel (EntityResolver, LSResourceResolver, URIResolver, and XMLResolver), routing caller-supplied resolvers through it as allow-lists. Thanks to Piotr P. Karwasz, Gary Gregory. -* Harden the SAXTransformerFactory extension surface (TransformerHandler, TemplatesHandler, and XMLFilter) and TransformerFactory.getAssociatedStylesheet. Thanks to Piotr P. Karwasz, Gary Gregory. +* Secure the SAXTransformerFactory extension surface (TransformerHandler, TemplatesHandler, and XMLFilter) and TransformerFactory.getAssociatedStylesheet. Thanks to Piotr P. Karwasz, Gary Gregory. * Document the threat model on the project site, including the denied-fetch contract and the supported runtime floor (OpenJDK 8 and Android API 33 or later). Thanks to Piotr P. Karwasz, Jarek Potiuk, Gary Gregory. * COMMONSXML-11: Add GitHub CI builds for Java 26 and 27-EA. Thanks to Gary Gregory, Piotr P. Karwasz. @@ -42,7 +42,7 @@ Fixed Bugs * COMMONSXML-10: Block XInclude (xi:include) href resolution by default, since the JAXP external-access properties do not govern it. Thanks to Ta Duc Thien, Piotr P. Karwasz, Gary Gregory. * Restore the hardened configuration when a factory or parser is reset() instead of reverting to the implementation defaults. Thanks to Piotr P. Karwasz, Gary Gregory. * Parse a Source opted in by a caller-supplied URIResolver using a hardened parser. Thanks to Piotr P. Karwasz, Gary Gregory. -* Harden the document parse behind the InputSource-taking XPath evaluation entry points. Thanks to Piotr P. Karwasz, Gary Gregory. +* Secure the document parse behind the InputSource-taking XPath evaluation entry points. Thanks to Piotr P. Karwasz, Gary Gregory. Changes ------- diff --git a/src/changes/changes.xml b/src/changes/changes.xml index d4f86d5..9e2f291 100644 --- a/src/changes/changes.xml +++ b/src/changes/changes.xml @@ -37,16 +37,16 @@ The <action> type attribute can be add, update, fix, or remove. <!-- ADD --> <action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Add secure-by-default JAXP factory creation via org.apache.commons.xml, donated from the copernik-xml-factory project (https://github.com/copernik-eu/copernik-xml-factory) and covering the stock JDK, Android, Apache Xalan, Apache Xerces, Woodstox, and Saxon-HE.</action> <action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory" issue="COMMONSXML-9">Install a non-removable resolver floor on every resolver channel (EntityResolver, LSResourceResolver, URIResolver, and XMLResolver), routing caller-supplied resolvers through it as allow-lists.</action> - <action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Harden the SAXTransformerFactory extension surface (TransformerHandler, TemplatesHandler, and XMLFilter) and TransformerFactory.getAssociatedStylesheet.</action> + <action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Secure the SAXTransformerFactory extension surface (TransformerHandler, TemplatesHandler, and XMLFilter) and TransformerFactory.getAssociatedStylesheet.</action> <action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Jarek Potiuk, Gary Gregory">Document the threat model on the project site, including the denied-fetch contract and the supported runtime floor (OpenJDK 8 and Android API 33 or later).</action> <action type="add" dev="ppkarwasz" due-to="Gary Gregory, Piotr P. Karwasz" issue="COMMONSXML-11">Add GitHub CI builds for Java 26 and 27-EA.</action> <action type="add" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Mirror on each factory class every JAXP static factory method, including the Java 9 newDefaultInstance and Java 13 newNSInstance families, all usable on Java 8.</action> <!-- FIX --> <action type="fix" dev="ppkarwasz" due-to="Ta Duc Thien, Piotr P. Karwasz, Gary Gregory" issue="COMMONSXML-10">Block XInclude (xi:include) href resolution by default, since the JAXP external-access properties do not govern it.</action> <action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Honor jdk.xml.overrideDefaultParser on TrAX, XPath and schema factories that recognize it.</action> - <action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Restore the hardened configuration when a factory or parser is reset() instead of reverting to the implementation defaults.</action> + <action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Restore the secure configuration when a factory or parser is reset() instead of reverting to the implementation defaults.</action> <action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Parse a Source opted in by a caller-supplied URIResolver using a hardened parser.</action> - <action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Harden the document parse behind the InputSource-taking XPath evaluation entry points.</action> + <action type="fix" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory">Secure the document parse behind the InputSource-taking XPath evaluation entry points.</action> <!-- UPDATE --> <action type="update" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory" issue="COMMONSXML-1,COMMONSXML-5,COMMONSXML-6,COMMONSXML-7,COMMONSXML-8">Recognize XML implementations by the JAXP features and properties they support instead of by their implementation class name, extending the hardening to any compliant implementation.</action> <action type="update" dev="ppkarwasz" due-to="Piotr P. Karwasz, Gary Gregory" issue="COMMONSXML-4">Define a consistent contract for denied external fetches: unresolved external references resolve to empty content on every implementation, unless the org.apache.commons.xml.throwOnUnresolved system property requests rejection.</action> diff --git a/src/main/java/org/apache/commons/xml/SaxonProvider.java b/src/main/java/org/apache/commons/xml/SaxonProvider.java index 551c079..b8d3caf 100644 --- a/src/main/java/org/apache/commons/xml/SaxonProvider.java +++ b/src/main/java/org/apache/commons/xml/SaxonProvider.java @@ -46,7 +46,7 @@ final class SaxonProvider { /** * Sole holder of Saxon symbolic references, so that the outer class verifies without Saxon on the classpath. * - * <p>{@link SaxonProvider#isSaxon} runs on every harden call, Saxon present or not, and the JVM verifier may load classes eagerly to prove class-typed + * <p>{@link SaxonProvider#isSaxon} runs on every secure call, Saxon present or not, and the JVM verifier may load classes eagerly to prove class-typed * assignability; keeping every Saxon reference in this nested class defers that loading until a Saxon factory has actually been recognized.</p> */ private static final class SaxonProviderConfigurer { diff --git a/src/main/java/org/apache/commons/xml/SecureSchemaFactory.java b/src/main/java/org/apache/commons/xml/SecureSchemaFactory.java index 8a0d40b..7be84ba 100644 --- a/src/main/java/org/apache/commons/xml/SecureSchemaFactory.java +++ b/src/main/java/org/apache/commons/xml/SecureSchemaFactory.java @@ -177,7 +177,7 @@ private Source[] secure(final Source[] schemas) throws SAXException { secure[i] = SecureSAXParserFactory.secure(schemas[i], overrideDefaultParser); } } catch (final TransformerConfigurationException e) { - throw new SAXException("Failed to harden schema source", e); + throw new SAXException("Failed to secure schema source", e); } return secure; } diff --git a/src/main/java/org/apache/commons/xml/SecureTransformerFactory.java b/src/main/java/org/apache/commons/xml/SecureTransformerFactory.java index 232482a..1a1dd61 100644 --- a/src/main/java/org/apache/commons/xml/SecureTransformerFactory.java +++ b/src/main/java/org/apache/commons/xml/SecureTransformerFactory.java @@ -266,7 +266,7 @@ public TemplatesHandler newTemplatesHandler() throws TransformerConfigurationExc @Override public Transformer newTransformer() throws TransformerConfigurationException { - // Identity transformer: still parses runtime sources, so wrap it to harden Transformer.transform(Source, Result). + // Identity transformer: still parses runtime sources, so wrap it to secure Transformer.transform(Source, Result). final Transformer transformer = delegate.newTransformer(); return transformer == null ? null : new SecureTransformer(transformer, getURIResolver(), emptySource, overrideDefaultParser()); } diff --git a/src/main/java/org/apache/commons/xml/SecureValidator.java b/src/main/java/org/apache/commons/xml/SecureValidator.java index c67e541..6497b2f 100644 --- a/src/main/java/org/apache/commons/xml/SecureValidator.java +++ b/src/main/java/org/apache/commons/xml/SecureValidator.java @@ -123,7 +123,7 @@ public void validate(final Source source, final Result result) throws SAXExcepti try { delegate.validate(SecureSAXParserFactory.secure(source, overrideDefaultParser), result); } catch (final TransformerConfigurationException e) { - throw new SAXException("Failed to harden source for validation", e); + throw new SAXException("Failed to secure source for validation", e); } } } diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md index 6f89c87..4b11600 100644 --- a/src/site/markdown/index.md +++ b/src/site/markdown/index.md @@ -27,8 +27,8 @@ stock JDK and external JAXP implementations. ## Why -Any Java library that parses XML has to harden JAXP before handing a factory to user code, and every library ends up -copy-pasting the same hardening snippet. The snippet is fragile: the attributes and features needed to harden a factory +Any Java library that parses XML has to secure JAXP before handing a factory to user code, and every library ends up +copy-pasting the same hardening snippet. The snippet is fragile: the attributes and features needed to secure a factory are not standardized, each JAXP implementation exposes a slightly different set, and setting an unknown one throws an exception that callers routinely swallow. Writing this block correctly for every implementation is real work, and duplicating it across projects means every project owns the maintenance burden on its own.
