| Type |
Changes |
By |
 |
This is the first release of Apache Commons Secure XML. Thanks to Piotr P. Karwasz, Gary Gregory. |
ggregory |
|
Add secure-by-default JAXP factory creation via org.apache.commons.xml.secure, donated from the copernik-xml-factory project (https://github.com/copernik-eu/copernik-xml-factory) and covering the stock JDK, Android, Apache Xalan, Apache Xerces, Woodstox, and Saxon-HE. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
|
Install a non-removable resolver floor on every resolver channel (EntityResolver, LSResourceResolver, URIResolver, and XMLResolver), routing caller-supplied resolvers through it as allow-lists. Fixes COMMONSXML-9. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
|
Secure the SAXTransformerFactory extension surface (TransformerHandler, TemplatesHandler, and XMLFilter) and TransformerFactory.getAssociatedStylesheet. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
|
Document the threat model on the project site, including the denied-fetch contract and the supported runtime floor (OpenJDK 8 and Android API 33 or later). Thanks to Piotr P. Karwasz, Jarek Potiuk, Gary Gregory. |
ppkarwasz |
|
Add GitHub CI builds for Java 26 and 27-EA. Fixes COMMONSXML-11. Thanks to Gary Gregory, Piotr P. Karwasz. |
ppkarwasz |
|
Mirror on each factory class every JAXP static factory method, including the Java 9 newDefaultInstance and Java 13 newNSInstance families, all usable on Java 8. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
 |
Block XInclude (xi:include) href resolution by default, since the JAXP external-access properties do not govern it. Fixes COMMONSXML-10. Thanks to Ta Duc Thien, Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
|
Honor jdk.xml.overrideDefaultParser on TrAX, XPath and schema factories that recognize it. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
|
Restore the secure configuration when a factory or parser is reset() instead of reverting to the implementation defaults. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
|
Parse a Source opted in by a caller-supplied URIResolver using a secure parser. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
|
Secure the document parse behind the InputSource-taking XPath evaluation entry points. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
|
Fall back to the standard factory lookup in the DOM, SAX and schema newDefaultInstance methods on Android. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
 |
Recognize XML implementations by the JAXP features and properties they support instead of by their implementation class name, extending the securing to any compliant implementation. Fixes COMMONSXML-1,COMMONSXML-5,COMMONSXML-6,COMMONSXML-7,COMMONSXML-8. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
|
Define a consistent contract for denied external fetches: unresolved external references resolve to empty content on every implementation, unless the org.apache.commons.xml.secure.throwOnUnresolved system property requests rejection. Fixes COMMONSXML-4. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
|
Reduce the shaded footprint by splitting the secure classes and resolver floors into independent entry points. Fixes COMMONSXML-3. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
 |
Remove the Limits class that applied uniform processing limits across implementations. Fixes COMMONSXML-2. Thanks to Piotr P. Karwasz, Gary Gregory. |
ppkarwasz |
