This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 208e00d78f2f7dd6d3fb633873c2571ddd09d5f2 Author: Gary Gregory <[email protected]> AuthorDate: Sun Aug 30 08:28:22 2026 -0400 Add a TL;DR and OpenRewrite recipe. --- .../org/apache/commons/xml/doc-files/rewrite.yml | 38 ++++++++++++++++++ src/main/javadoc/overview.html | 46 ++++++++++++++++++++-- src/site/markdown/index.md | 7 ++-- 3 files changed, 85 insertions(+), 6 deletions(-) diff --git a/src/main/java/org/apache/commons/xml/doc-files/rewrite.yml b/src/main/java/org/apache/commons/xml/doc-files/rewrite.yml new file mode 100644 index 0000000..dc9c074 --- /dev/null +++ b/src/main/java/org/apache/commons/xml/doc-files/rewrite.yml @@ -0,0 +1,38 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +type: specs.openrewrite.org/v1beta/recipe +name: org.apache.commons.xml.UseSecureXmlFactories +displayName: Use Apache Commons secure XML factories +description: Replaces JAXP factory types with their Apache Commons XML secure equivalents. +recipeList: + - org.openrewrite.java.ChangeType: + oldFullyQualifiedTypeName: javax.xml.parsers.DocumentBuilderFactory + newFullyQualifiedTypeName: org.apache.commons.xml.SecureDocumentBuilderFactory + - org.openrewrite.java.ChangeType: + oldFullyQualifiedTypeName: javax.xml.parsers.SAXParserFactory + newFullyQualifiedTypeName: org.apache.commons.xml.SecureSAXParserFactory + - org.openrewrite.java.ChangeType: + oldFullyQualifiedTypeName: javax.xml.validation.SchemaFactory + newFullyQualifiedTypeName: org.apache.commons.xml.SecureSchemaFactory + - org.openrewrite.java.ChangeType: + oldFullyQualifiedTypeName: javax.xml.transform.TransformerFactory + newFullyQualifiedTypeName: org.apache.commons.xml.SecureTransformerFactory + - org.openrewrite.java.ChangeType: + oldFullyQualifiedTypeName: javax.xml.stream.XMLInputFactory + newFullyQualifiedTypeName: org.apache.commons.xml.SecureXMLInputFactory + - org.openrewrite.java.ChangeType: + oldFullyQualifiedTypeName: javax.xml.xpath.XPathFactory + newFullyQualifiedTypeName: org.apache.commons.xml.SecureXPathFactory diff --git a/src/main/javadoc/overview.html b/src/main/javadoc/overview.html index b780a87..5bba4ca 100644 --- a/src/main/javadoc/overview.html +++ b/src/main/javadoc/overview.html @@ -19,18 +19,58 @@ <title>Apache Commons Secure XML Overview</title> </head> <body> - <a href="https://commons.apache.org/xml";><img src="org/apache/commons/xml/doc-files/logo.png" alt="Apache Commons Secure XML"> - </a> + <a href="https://commons.apache.org/xml";><img src="org/apache/commons/xml/doc-files/logo.png" alt="Apache Commons Secure XML"> </a> <section id="apache-commons-secure-xml"> <h1> <img src="org/apache/commons/xml/doc-files/leaf.svg" style="height: 1em; padding-right: 0.25em" alt="leaf">Apache Commons Secure XML </h1> <p> - <a href="https://commons.apache.org/xml";>Apache Commons Secure XML</a> is part of the <a href="https://commons.apache.org/index.html";>Apache Commons</a> project. + <a href="https://commons.apache.org/xml";>Apache Commons Secure XML</a> is part of the <a href="https://commons.apache.org/index.html";>Apache Commons</a> + project. </p> <p>Apache Commons Secure XML provides secure-by-default JAXP factory creation, abstracting over implementation-specific XXE securing differences between the stock JDK and external JAXP implementations.</p> </section> + <section id="tldr"> + <h1> + <img src="org/apache/commons/xml/doc-files/leaf.svg" style="height: 1em; padding-right: 0.25em" alt="leaf">TL;DR + </h1> + <p>To secure XML processing:</p> + <table> + <caption>JAXP to Apache Commons Secure XML</caption> + <tr> + <th>Replace JAXP</th> + <th>with Commons Secure XML</th> + </tr> + <tr> + <td><code>javax.xml.parsers.DocumentBuilderFactory</code></td> + <td><code>org.apache.commons.xml.SecureDocumentBuilderFactory</code></td> + </tr> + <tr> + <td><code>javax.xml.parsers.SAXParserFactory</code></td> + <td><code>org.apache.commons.xml.SecureSAXParserFactory</code></td> + </tr> + <tr> + <td><code>javax.xml.validation.SchemaFactory</code></td> + <td><code>org.apache.commons.xml.SecureSchemaFactory</code></td> + </tr> + <tr> + <td><code>javax.xml.transform.TransformerFactory</code></td> + <td><code>org.apache.commons.xml.SecureTransformerFactory</code></td> + </tr> + <tr> + <td><code>javax.xml.stream.XMLInputFactory</code></td> + <td><code>org.apache.commons.xml.SecureXMLInputFactory</code></td> + </tr> + <tr> + <td><code>javax.xml.xpath.XPathFactory</code></td> + <td><code>org.apache.commons.xml.SecureXPathFactory</code></td> + </tr> + </table> + <p> + Or use the <a href="org/apache/commons/xml/doc-files/rewrite.yml">OpenRewrite recipe</a>. + </p> + </section> <section id="why"> <h1> <img src="org/apache/commons/xml/doc-files/leaf.svg" style="height: 1em; padding-right: 0.25em" alt="leaf">Why diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md index ed23283..1826083 100644 --- a/src/site/markdown/index.md +++ b/src/site/markdown/index.md @@ -24,6 +24,7 @@ stock JDK and external JAXP implementations. Full documentation is provided in: -- [Javadoc Overview](apidocs/index.html), -- [Javadoc Package Summary](apidocs/org/apache/commons/xml/package-summary.html), and -- [Project Reports](project-reports.html). +- [**TL;DR**](apidocs/index.html#tldr) +- [Javadoc Overview](apidocs/index.html) +- [Javadoc Package Summary](apidocs/org/apache/commons/xml/package-summary.html) +- [Project Reports](project-reports.html)
