ppkarwasz opened a new pull request, #43: URL: https://github.com/apache/commons-xml/pull/43
Two threat-model clarifications; documentation only, no code change. ## Scope stated by property contract (f009) **What is in scope** no longer enumerates "JAXP implementations it recognizes". `XmlFactories` recognizes properties, not implementations: every JAXP implementation is in scope as long as it respects the contract of the features, attributes, and properties the hardening recipes use, and an implementation that cannot accept a required setting makes the factory method throw instead of returning an unhardened factory. The out-of-scope bullet, the known-non-findings bullet, and the `OUT-OF-SCOPE: foreign implementation` triage row are reworded to the same criterion. This also settles the remark about the StAX path: the StAX floor is installed through the standard `javax.xml.stream.resolver` hook, which the StAX specification requires every implementation to support, so it falls under the same contract with no per-API exception. ## Transform output destinations are out of scope (f010) New out-of-scope bullet plus a matching known-non-findings bullet: the hardening governs what a parse or transform reads, not where a transform writes. A stylesheet's output-producing instructions (`xsl:result-document` in particular) write wherever the stylesheet directs, within the runtime's permissions; running a stylesheet grants its author that capability, so restricting destinations when the stylesheet is untrusted is the operator's responsibility (an output resolver of the implementation, filesystem permissions, or process sandboxing). Path-traversal or file-write reports through stylesheet output instructions now have an explicit disposition. ## Note The in-scope bullet is also touched by #38 (Android best-effort wording) and the out-of-scope area by #41 (SAXTransformerFactory surface); whichever lands later reconciles small conflicts, keeping the contract framing together with those changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
