bamaer commented on PR #8947:
URL: https://github.com/apache/hop/pull/8947#issuecomment-6195889508

   @hansva thanks, all addressed in the last commit:
   
   1. The protective features are set one by one; a DOCTYPE is only allowed 
when all of them took. Tested with a parser that lacks one.
   2. Both now use `XmlParserFactoryProducer.isDoctypeAllowed()`, with core's 
rule (only `N` refuses), so core doesn't change. Hop sets `N` at startup, so a 
default install refuses in both.
   3. Includes, imports and `document()` go through a HopVfs `URIResolver`. 
When nothing is found next to the stylesheet it falls back to the old 
resolution, so absolute paths and includes in the working directory keep 
working (tested against `main`). Includes in zipped stylesheets now resolve.
   4. Right, Saxon is the JAXP provider in a Hop install. The resolver isn't 
installed on a factory that refuses external stylesheets, so XSLTC still 
refuses includes; tests force XSLTC for that.
   5. The dialog now saves the English text (`Node`/`Attribute`) in every 
language. Older versions keep reading it; the lowercase code would break them. 
The cross-language lookup stays for files saved before.
   6. Without rows, the root keeps its forced/default attributes, its own value 
and the static elements; mapped values are empty. With the loop on the root, or 
a tree that doesn't validate, the file stays empty as before. Streams close in 
`finally`, errors add to the count, and the docs are fixed.
   7. With a DOCTYPE allowed, entity text is capped at 50,000,000 characters 
(the JDK's default), in element text and in attributes.
   8. They differ when opening the path fails halfway: the root is already 
written but the key isn't set, and closing would add a second root. Kept the 
flag.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to