ppkarwasz opened a new pull request, #34: URL: https://github.com/apache/commons-xml/pull/34
Both methods were speculative additions to the public API. Reviewing the cases they were meant to serve, none survives: - **Sources handed over by a runtime** (JAX-WS `Provider<Source>`, Camel message bodies, Spring-WS payloads) are the runtime's responsibility to parse safely. Camel documents this guarantee explicitly in its security model. An application defensively re-hardening them is papering over a framework bug, not fixing its own. - **Readers created inside the library** no longer exist. Commons XML wraps Xalan and the JDK fork so that every `Source` is internally equipped with a hardened reader; `XMLReaderFactory.createXMLReader()` is never reached. - **Explicitly injected readers** (e.g. `Digester.setXMLReader`) belong to the caller. If a user supplies a reader, they own its configuration, and silently re-wrapping it would make behavior harder to reason about rather than safer. - **Downstream adopters** such as Commons Digester and Ant's `JAXPUtils` delegate factory creation wholesale, which needs no reader-level entry point. Removing them keeps the pre-1.0 surface to what has demonstrated demand. These can be reintroduced in a later minor release if a real use case appears; they cannot be withdrawn once shipped. > [!NOTE] > The `harden(Source)` might be applicable in `Unmarshaller.unmarshal`, but that hardening either belongs to the JAXB implementation or a separate `commons-xml-jaxb` artifact. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
