ppkarwasz commented on code in PR #43: URL: https://github.com/apache/commons-xml/pull/43#discussion_r3857068254
########## src/site/markdown/threat_model.md: ########## @@ -74,7 +74,12 @@ because your reader's settings are indistinguishable from configuration you chos ### What is in scope -- The hardening recipes applied by `XmlFactories` to the JAXP implementations it recognizes (stock JDK, Apache Xerces, Xalan, Saxon, and Woodstox). +- The hardening recipes applied by `XmlFactories`. + Every JAXP implementation is in scope, Review Comment: Good point — pinned in 5beea39: the sentence now reads "Every implementation of JAXP 1.4 or later is in scope". JAXP 1.4 is the actual baseline the recipes need: the newest platform API they require is StAX (added in 1.4), and the JAXP 1.5 `ACCESS_EXTERNAL_*` properties are deliberately unused (the resolver floors replace them; they appear under **Reserved settings** only as must-not-loosen). The next sentence keeps the claim testable by scoping conformance to the specific features, attributes, and properties each recipe uses, rather than whole-spec conformance. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
