[GH] (commons-xml/feature/document-builder-hardening): Workflow run "Java CI" failed!

[GitBox <gi...@apache.org>]

The GitHub Actions job "Java CI" on commons-xml.git/feature/document-builder-hardening has failed.
Run started by GitHub user ppkarwasz (triggered by ppkarwasz).

Head commit for run:
68ad1d14a9a83aa3dd5b87b94f796b2408176e67 / Piotr P. Karwasz <pk...@apache.org>
Add minimal-footprint DocumentBuilderHardener.newInstance() entry point

Expose DocumentBuilderHardener with a public newInstance() so consumers that
only need a hardened DocumentBuilderFactory can shade the library and copy a
minimal set of classes. jdependency (the engine maven-shade-plugin's
minimizeJar uses) works at class granularity, so the shaded set is the
transitive closure of this one class.

To keep that closure small, install a deny-all EntityResolver as a lambda
local to DocumentBuilderHardener instead of reusing Resolvers.DenyAll.ENTITY2.
EntityResolver's resolveEntity(publicId, systemId) hook is consulted for the
external DTD subset and every external entity, so it blocks all external
fetches on the DOM path just as well, while dropping the whole Resolvers
nested-class tree from the closure (12 -> 7 class files).

Route XmlFactories.newDocumentBuilderFactory() through the new entry point, and
add ShadingFootprintTest, which uses jdependency to pin the reachable set to
exactly those 7 classes so the footprint cannot silently grow back toward the
full library.

Assisted-By: Claude Opus 4.8 (1M context) <no...@anthropic.com>

Report URL: https://github.com/apache/commons-xml/actions/runs/27898022731

With regards,
GitHub Actions via GitBox