ppkarwasz opened a new pull request, #43:
URL: https://github.com/apache/commons-xml/pull/43

   Two threat-model clarifications; documentation only, no code change.
   
   ## Scope stated by property contract (f009)
   
   **What is in scope** no longer enumerates "JAXP implementations it 
recognizes". `XmlFactories` recognizes properties, not implementations: every 
JAXP implementation is in scope as long as it respects the contract of the 
features, attributes, and properties the hardening recipes use, and an 
implementation that cannot accept a required setting makes the factory method 
throw instead of returning an unhardened factory.
   
   The out-of-scope bullet, the known-non-findings bullet, and the 
`OUT-OF-SCOPE: foreign implementation` triage row are reworded to the same 
criterion. This also settles the remark about the StAX path: the StAX floor is 
installed through the standard `javax.xml.stream.resolver` hook, which the StAX 
specification requires every implementation to support, so it falls under the 
same contract with no per-API exception.
   
   ## Transform output destinations are out of scope (f010)
   
   New out-of-scope bullet plus a matching known-non-findings bullet: the 
hardening governs what a parse or transform reads, not where a transform 
writes. A stylesheet's output-producing instructions (`xsl:result-document` in 
particular) write wherever the stylesheet directs, within the runtime's 
permissions; running a stylesheet grants its author that capability, so 
restricting destinations when the stylesheet is untrusted is the operator's 
responsibility (an output resolver of the implementation, filesystem 
permissions, or process sandboxing). Path-traversal or file-write reports 
through stylesheet output instructions now have an explicit disposition.
   
   ## Note
   
   The in-scope bullet is also touched by #38 (Android best-effort wording) and 
the out-of-scope area by #41 (SAXTransformerFactory surface); whichever lands 
later reconciles small conflicts, keeping the contract framing together with 
those changes.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to