ppkarwasz commented on code in PR #94:
URL: https://github.com/apache/commons-secure-xml/pull/94#discussion_r4000984157
##########
src/main/java/org/apache/commons/xml/secure/SecureTransformerFactory.java:
##########
@@ -308,10 +308,22 @@ public TransformerHandler newTransformerHandler(final
Source source) throws Tran
return
secure(delegate.newTransformerHandler(SecureSAXParserFactory.secure(source,
overrideDefaultParser())));
}
+ /**
+ * {@inheritDoc}
+ *
+ * <p>Most implementations reject a {@link Templates} they did not
compile, some in the TrAX shape, others by casting it or its Transformer to
their
+ * own type. Both reach the caller as a {@link
TransformerConfigurationException}.</p>
+ */
@Override
public TransformerHandler newTransformerHandler(final Templates
templates) throws TransformerConfigurationException {
// Implementations cast templates.newTransformer() to their own
Transformer type, so hand them the wrapped implementation Templates, not the
wrapper.
- return secure(delegate.newTransformerHandler(unwrap(templates)));
+ final Templates unwrapped = unwrap(templates);
+ try {
+ return secure(delegate.newTransformerHandler(unwrapped));
+ } catch (final ClassCastException e) {
+ throw new TransformerConfigurationException("Failed to create
a TransformerHandler from a Templates of type "
+ + unwrapped.getClass().getName(), e);
Review Comment:
Fixed in
https://github.com/apache/commons-secure-xml/pull/94/commits/96db8cffce033de4907739fc7225986e773e718a
All the other methods in `TransformerFactory` throw an NPE on a `null`
input, so this one will throw one too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
