ppkarwasz opened a new pull request, #289: URL: https://github.com/apache/commons-digester/pull/289
> [!WARNING] > This PR was submitted automatically to smoke-test > [Apache Commons Secure XML](https://github.com/apache/commons-xml) > and has not yet been verified by a human. > It will stay a draft until a committer reviews it and marks it ready. Creates SAX parser and document builder factories through `org.apache.commons:commons-secure-xml` (1.0.0-SNAPSHOT until its first release) in `commons-digester3-core`. The secure factories enable XML secure processing and install a non-removable entity-resolver floor: external DTD, entity, schema and XInclude lookups that a caller-set resolver does not resolve are resolved to empty content instead of being fetched, and internal entity expansion is bounded. - `Digester.getFactory()` and `DigesterLoader` go through `SecureSAXParserFactory`, `NodeCreateRule` through `SecureDocumentBuilderFactory`. The caller-facing configuration (namespace and XInclude awareness, validation, schema, features and properties) keeps working, and `getFactory()` still returns a plain `SAXParserFactory`. - `Digester` itself acts as the entity resolver of the readers it creates, and resolvers installed by the caller keep precedence over the floor, so registered entities, relative DTDs and DTD validation resolve exactly as before; the floor only takes effect for parsers whose resolver chain leaves a lookup unresolved. All DTD-validation, entity-resolution, XInclude and schema tests pass unchanged. - Callers supplying their own `SAXParser` or `XMLReader` keep full control of their parser configuration. - CI and CodeQL run with `-Puse-apache-snapshots` so the SNAPSHOT dependency resolves. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
