ppkarwasz opened a new pull request, #65: URL: https://github.com/apache/commons-xml/pull/65
The securing is independent of the JAXP 1.5 external-access properties (`accessExternalDTD`, `accessExternalSchema`, `accessExternalStylesheet`): by specification, a resource supplied by a registered resolver bypasses their checks, and the resolver floor covers every external reference. No value a caller sets loosens the securing, and no value is needed to keep it — the known JDK defects that apply the checks even to resolver-supplied documents all fail closed. This change therefore: - moves the three properties from the reserved list to **Settings you may modify** in the threat model, including their system-property counterparts; - adds a Javadoc overview section explaining why the securing builds on resolver floors rather than on these properties (resolver precedence, the XInclude gap they cannot cover, and the fail-closed JDK defects); - adds `AccessExternalPropertyTest`, which loosens each property to `all` on a secured factory and asserts the external fetch still does not happen, across DOM, SAX, schema compilation and TrAX; - extends `AttackTestSupport` with caller-configured-factory overloads of the existing no-leak assertions, and fixes a few `Thesecuring` typos in the threat model. Tests pass across the full surefire implementation matrix; implementations that reject the properties (no knob to loosen) skip via assumptions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_014Hm8EbPnSdQeuQfsoFwQt1 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
