ppkarwasz opened a new pull request, #941: URL: https://github.com/apache/ws-axiom/pull/941
Fixes [AXIOM-530](https://issues.apache.org/jira/browse/AXIOM-530) ## Motivation Last week we released [Apache Commons Secure XML](https://commons.apache.org/proper/commons-secure-xml/), a single source of secured JAXP factories across the stock JDK and external implementations. To keep both the factories and the readers they produce easy to use, the library hands out wrappers. For StAX, the wrapper installs an ignore-all resolver floor that users cannot remove by accident: a resolver set by the caller is chained in front of the floor rather than replacing it. Axiom is where this approach currently breaks down. `StAXDialectDetector` identifies the StAX implementation solely from the location of the factory class: it looks up the JAR or `jrt:` module the class was loaded from and inspects its manifest and neighboring classes. For a wrapped factory the class is the wrapper's own, which says nothing about the implementation behind it. Axiom then logs "Unable to determine dialect of the StAX implementation" and falls back to `UnknownStAXDialect`, losing the implementation-specific normalization it relies on. In practice this makes Commons Secure XML unusable for Axis2 users. This is the same class of failure that [AXIOM-426](https://issues.apache.org/jira/browse/AXIOM-426) fixed for JBoss AS 7 with a reflective unwrapper, and that [AXIOM-503](https://issues.apache.org/jira/browse/AXIOM-503) and [AXIOM-505](https://issues.apache.org/jira/browse/AXIOM-504) hit through manifests. Rather than adding one more adhoc rule, this change relies on information that does not depend on the factory class at all. ## Changes Before falling back to the existing location-based detection, query the factory for properties that identify the implementation. Factory wrappers pass property queries through to the wrapped factory, so this works for wrapped factories: - `org.codehaus.stax2.implName` (StAX2 API, supported by Woodstox 4+ and Aalto) and Sun's `implementation-name` property (SJSXP) report the implementation name. - The implementation shipped with the JRE does not report its name. It is recognized by Zephyr-specific properties that no other known implementation supports: `ignore-external-dtd` on input factories and `reuse-instance` on output factories. The location-based detection, including the JBoss unwrapper, is left untouched as a fallback for the legacy implementations that expose no identifying property (BEA reference implementation, WebLogic, IBM XLXP). Whether that code should eventually go is a separate decision for the maintainers. The property behavior was verified against the sources of Woodstox 4.4.1 and 7.2.2, Aalto 1.3.3, SJSXP 1.0.2, the BEA reference implementation 1.2.0 and the JDK 17 `java.xml` module. ## Backports A small ask, should this PR be accepted: could it be backported to 1.x? Like many in the XML world, I have former clients stuck on JDK 8. Commons Secure XML could improve their security posture, and an official `1.4.1` release would serve them better than a private fork. The patch uses a pattern-matching `instanceof` and an arrow `switch`, so a 1.x backport needs a small syntax adjustment for the Java 8 baseline; I am happy to prepare it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
