ppkarwasz opened a new pull request, #39:
URL: https://github.com/apache/commons-xml/pull/39
## Summary
The `XmlFactories.harden(XMLReader)` and `XmlFactories.harden(Source)`
methods were removed from the public API in #37, but the threat model still
pointed callers at `harden(XMLReader)`.
Under *What is out of scope → Caller-supplied parser instances*, the
guidance now tells callers to obtain a hardened reader from
`XmlFactories.newSAXParserFactory()` before wrapping it in a `SAXSource`, which
is exactly the replacement #37's commit message recommends.
Documentation only; single-line change.
## Note
There is a second, unrelated stale reference to the removed API in a test's
Javadoc `{@link}` (`ShadingFootprintTest.java:72` links to
`SAXParserHardener#harden(Source)`, which was renamed to
`hardenSource(Source)`). It is left out of this PR to keep the scope to the
threat model; happy to fix it here or in a follow-up.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
