ppkarwasz opened a new pull request, #38: URL: https://github.com/apache/commons-xml/pull/38
## Summary Documents the supported-runtime floor so the hardening guarantees match what the platform can actually enforce, addressing the Android-below-33 gap where the bounded entity-expansion (Billion Laughs) guarantee does not hold. The guarantee relies on the platform's secure-processing limit. On Android that limit is libexpat's built-in billion-laughs check, which first ships in **API level 33** (AOSP libexpat >= 2.4). On Android below 33 there is no such check, so the previously unconditional bounded-expansion guarantee cannot hold. A JDK older than 8 needs no such caveat: the classes are compiled for Java 8 and cannot be loaded on an earlier one. ## Changes - **`XmlFactories` class Javadoc**: the bounded-expansion guarantee is now "bounded by the platform's secure-processing limit", with a note that the guarantees are defined on OpenJDK 8+ / Android API 33+ and do not hold on Android below 33. - **`threat_model.md`**: new **Supported runtimes** paragraph under *Assumptions about the environment*; the existing Billion Laughs claim is scoped to the supported runtimes; new **What is out of scope** and **Known non-findings** bullets for an unsupported Android release; **Conditions that would change this model** now lists a change to the supported runtimes. - **`index.md`**: new **Supported runtimes** subsection under *Usage*. ## Notes - Documentation only. No behavior change; `android-tests` `minSdk` stays 19 (the library still runs below 33, it is just not security-supported there). - Prose under `src/site/markdown` uses semantic line breaks per project convention. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
