This is an automated email from the ASF dual-hosted git repository. ppkarwasz pushed a commit to branch feat/use-commons-xml in repository https://gitbox.apache.org/repos/asf/commons-graph.git
commit 101c3ac0163fe00c8ae858982e7f9e6de233269f Author: Piotr P. Karwasz <[email protected]> AuthorDate: Mon Aug 31 15:17:47 2026 +0200 Harden XML output via commons-secure-xml Create the GraphML exporter's transformer factory through org.apache.commons:commons-secure-xml. The secure factory enables FEATURE_SECURE_PROCESSING on the transformers it produces and bounds their resource usage, regardless of the JAXP implementation on the classpath. The exporter performs an output-only identity transform, so the serialized GraphML is unchanged. Changes: - Add the commons-secure-xml dependency (1.0.0-SNAPSHOT until its first release). - Route factory creation through SecureTransformerFactory in GraphMLExporter; its wrapper extends SAXTransformerFactory, so the existing cast keeps working. - Declare the use-apache-snapshots profile locally (this POM's parent chain, org.apache:apache:33, predates it) and run the CI build with -Puse-apache-snapshots so the commons-secure-xml SNAPSHOT resolves. Assisted-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MHgnMnGWHQoH2zD2jFdoMT --- .github/workflows/maven.yml | 4 ++-- pom.xml | 24 ++++++++++++++++++++++ src/changes/changes.xml | 3 +++ .../commons/graph/export/GraphMLExporter.java | 4 ++-- 4 files changed, 31 insertions(+), 4 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 2a01ceb..408ec16 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -63,6 +63,6 @@ jobs: distribution: 'temurin' java-version: ${{ matrix.java }} - name: Build with Maven - run: mvn --errors --show-version --batch-mode --no-transfer-progress install -D"maven.javadoc.skip=true" -D"org.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn" + run: mvn --errors --show-version --batch-mode --no-transfer-progress -Puse-apache-snapshots install -D"maven.javadoc.skip=true" -D"org.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn" - name: Generate jacoco:report - run: mvn --errors --show-version --batch-mode --no-transfer-progress jacoco:report # coveralls:report + run: mvn --errors --show-version --batch-mode --no-transfer-progress -Puse-apache-snapshots jacoco:report # coveralls:report diff --git a/pom.xml b/pom.xml index daa8cee..3e4c802 100644 --- a/pom.xml +++ b/pom.xml @@ -153,6 +153,11 @@ </properties> <dependencies> + <dependency> + <groupId>org.apache.commons</groupId> + <artifactId>commons-secure-xml</artifactId> + <version>1.0.0-SNAPSHOT</version> + </dependency> <dependency> <groupId>junit</groupId> <artifactId>junit</artifactId> @@ -314,6 +319,25 @@ </reporting> <profiles> + <!-- Same as in org.apache:apache:34+; the parent of this POM predates it. --> + <profile> + <id>use-apache-snapshots</id> + <activation> + <property> + <name>apache.snapshots</name> + </property> + </activation> + <repositories> + <repository> + <id>apache.snapshots</id> + <name>Apache Snapshot Repository</name> + <url>https://repository.apache.org/snapshots</url> + <releases> + <enabled>false</enabled> + </releases> + </repository> + </repositories> + </profile> <profile> <id>rc</id> <distributionManagement> diff --git a/src/changes/changes.xml b/src/changes/changes.xml index 0c9e0d4..cf7cfa2 100644 --- a/src/changes/changes.xml +++ b/src/changes/changes.xml @@ -23,6 +23,9 @@ </properties> <body> <release version="0.1" date="201?-??-??" description="First release."> + <action dev="pkarwasz" type="fix"> + Create XML transformers through org.apache.commons:commons-secure-xml, so GraphML export runs with XML secure processing enabled + </action> <action issue="SANDBOX-510" dev="kinow" due-to="Amey Jadiye" type="fix"> Unit tests failures in recently migrated "Commons Graph" </action> diff --git a/src/main/java/org/apache/commons/graph/export/GraphMLExporter.java b/src/main/java/org/apache/commons/graph/export/GraphMLExporter.java index 2a59386..e69b0ec 100644 --- a/src/main/java/org/apache/commons/graph/export/GraphMLExporter.java +++ b/src/main/java/org/apache/commons/graph/export/GraphMLExporter.java @@ -21,20 +21,20 @@ package org.apache.commons.graph.export; import java.util.Map; -import javax.xml.transform.TransformerFactory; import javax.xml.transform.sax.SAXTransformerFactory; import javax.xml.transform.sax.TransformerHandler; import javax.xml.transform.stream.StreamResult; import org.apache.commons.graph.Graph; import org.apache.commons.graph.Mapper; +import org.apache.commons.xml.secure.SecureTransformerFactory; import org.xml.sax.helpers.AttributesImpl; final class GraphMLExporter<V, E> extends AbstractExporter<V, E, GraphMLExporter<V, E>> { - private static final SAXTransformerFactory SAX_TRANSFORMER_FACTORY = (SAXTransformerFactory) TransformerFactory.newInstance(); + private static final SAXTransformerFactory SAX_TRANSFORMER_FACTORY = (SAXTransformerFactory) SecureTransformerFactory.newInstance(); private static final String GRAPHML = "graphml";
