ppkarwasz opened a new pull request, #42: URL: https://github.com/apache/commons-xml/pull/42
Tightens what the two `FallbackIgnore*` resolver floors do with a result the caller's delegate resolver returns, so an opted-in resource is consumed on the same hardening floor as everything else instead of at the implementation's internal-parser defaults. ## Changes ### `FallbackIgnoreURIResolver`: opted-in Sources are re-parsed hardened A non-null `Source` returned by a caller-supplied `URIResolver` was previously handed back verbatim. A `StreamSource` or reader-less `SAXSource` is then parsed by the reader the implementation provisions internally, at that reader's own defaults. The floor now rewrites such a result through `SAXParserHardener.hardenSource`, so the opted-in content is parsed by a hardened reader carrying the entity floor; a `DOMSource` or a `SAXSource` with the caller's own reader is returned as-is (the caller's reader is trusted configuration). ### `FallbackIgnoreLSResourceResolver`: opting in requires content A non-null `LSInput` was previously returned verbatim. One naming only identifiers (no character stream, byte stream, or string data) makes the implementation fall back to default resolution, resolving the system id itself with its internal parser. Such an `LSInput` is now treated as unresolved, exactly like a `null` return: it resolves to the empty input, or to an exception under `org.apache.commons.xml.throwOnUnresolved`. A caller who wants the resource available supplies its content on the `LSInput`; the library itself still performs no I/O. ## Tests Three new tests in `EntityResolverFloorTest`, next to the existing opt-in coverage: - `transformerParsesOptedInImportHardened` and `transformerParsesOptedInDocumentHardened` opt a stylesheet module and a `document()` target in through a caller `URIResolver`; the fixtures carry an external DTD reference whose entity would surface in the transform output if the opted-in handle were parsed at internal-reader defaults. Asserted as blocks-or-does-not-leak on every TrAX execution. - `schemaTreatsIdentifierOnlyOptInAsUnresolved` opts the `included.xsd` import in with an identifier-only `LSInput` and asserts the compile fails, since the import now resolves to empty. Each new test was verified to discriminate: with the floor changes reverted, the TrAX tests fail under XSLTC and Xalan (Saxon closes this path separately through its hardened pooled parser) and the schema test fails under the stock JDK and Xerces. Full surefire matrix (test-saxon, test-saxon-xerces, test-stockjdk, test-woodstox, test-xalan, test-xalan-xerces, test-xerces) green. ## Documentation The threat model's **Resolvers** bullet now states the opt-in semantics: an opted-in `Source` stays on the floor, and an `LSInput` must carry content or it is treated as unresolved. ## Note `FallbackIgnoreURIResolver` is also touched by #41; whichever lands second has a small conflict in `resolve()` to reconcile (and once both are in, the rewrite also applies to the floor instance #41 installs on Saxon's `Configuration`, which the Saxon executions should confirm). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
