You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by gg...@apache.org on 2026/08/30 12:49:02 UTC
(commons-xml) 04/05: Add a TL;DR and OpenRewrite recipe.
This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 208e00d78f2f7dd6d3fb633873c2571ddd09d5f2
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Sun Aug 30 08:28:22 2026 -0400
Add a TL;DR and OpenRewrite recipe.
---
.../org/apache/commons/xml/doc-files/rewrite.yml | 38 ++++++++++++++++++
src/main/javadoc/overview.html | 46 ++++++++++++++++++++--
src/site/markdown/index.md | 7 ++--
3 files changed, 85 insertions(+), 6 deletions(-)
diff --git a/src/main/java/org/apache/commons/xml/doc-files/rewrite.yml b/src/main/java/org/apache/commons/xml/doc-files/rewrite.yml
new file mode 100644
index 0000000..dc9c074
--- /dev/null
+++ b/src/main/java/org/apache/commons/xml/doc-files/rewrite.yml
@@ -0,0 +1,38 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+type: specs.openrewrite.org/v1beta/recipe
+name: org.apache.commons.xml.UseSecureXmlFactories
+displayName: Use Apache Commons secure XML factories
+description: Replaces JAXP factory types with their Apache Commons XML secure equivalents.
+recipeList:
+ - org.openrewrite.java.ChangeType:
+ oldFullyQualifiedTypeName: javax.xml.parsers.DocumentBuilderFactory
+ newFullyQualifiedTypeName: org.apache.commons.xml.SecureDocumentBuilderFactory
+ - org.openrewrite.java.ChangeType:
+ oldFullyQualifiedTypeName: javax.xml.parsers.SAXParserFactory
+ newFullyQualifiedTypeName: org.apache.commons.xml.SecureSAXParserFactory
+ - org.openrewrite.java.ChangeType:
+ oldFullyQualifiedTypeName: javax.xml.validation.SchemaFactory
+ newFullyQualifiedTypeName: org.apache.commons.xml.SecureSchemaFactory
+ - org.openrewrite.java.ChangeType:
+ oldFullyQualifiedTypeName: javax.xml.transform.TransformerFactory
+ newFullyQualifiedTypeName: org.apache.commons.xml.SecureTransformerFactory
+ - org.openrewrite.java.ChangeType:
+ oldFullyQualifiedTypeName: javax.xml.stream.XMLInputFactory
+ newFullyQualifiedTypeName: org.apache.commons.xml.SecureXMLInputFactory
+ - org.openrewrite.java.ChangeType:
+ oldFullyQualifiedTypeName: javax.xml.xpath.XPathFactory
+ newFullyQualifiedTypeName: org.apache.commons.xml.SecureXPathFactory
diff --git a/src/main/javadoc/overview.html b/src/main/javadoc/overview.html
index b780a87..5bba4ca 100644
--- a/src/main/javadoc/overview.html
+++ b/src/main/javadoc/overview.html
@@ -19,18 +19,58 @@
<title>Apache Commons Secure XML Overview</title>
</head>
<body>
- <a href="https://commons.apache.org/xml"><img src="org/apache/commons/xml/doc-files/logo.png" alt="Apache Commons Secure XML">
- </a>
+ <a href="https://commons.apache.org/xml"><img src="org/apache/commons/xml/doc-files/logo.png" alt="Apache Commons Secure XML"> </a>
<section id="apache-commons-secure-xml">
<h1>
<img src="org/apache/commons/xml/doc-files/leaf.svg" style="height: 1em; padding-right: 0.25em" alt="leaf">Apache Commons Secure XML
</h1>
<p>
- <a href="https://commons.apache.org/xml">Apache Commons Secure XML</a> is part of the <a href="https://commons.apache.org/index.html">Apache Commons</a> project.
+ <a href="https://commons.apache.org/xml">Apache Commons Secure XML</a> is part of the <a href="https://commons.apache.org/index.html">Apache Commons</a>
+ project.
</p>
<p>Apache Commons Secure XML provides secure-by-default JAXP factory creation, abstracting over implementation-specific XXE securing differences between
the stock JDK and external JAXP implementations.</p>
</section>
+ <section id="tldr">
+ <h1>
+ <img src="org/apache/commons/xml/doc-files/leaf.svg" style="height: 1em; padding-right: 0.25em" alt="leaf">TL;DR
+ </h1>
+ <p>To secure XML processing:</p>
+ <table>
+ <caption>JAXP to Apache Commons Secure XML</caption>
+ <tr>
+ <th>Replace JAXP</th>
+ <th>with Commons Secure XML</th>
+ </tr>
+ <tr>
+ <td><code>javax.xml.parsers.DocumentBuilderFactory</code></td>
+ <td><code>org.apache.commons.xml.SecureDocumentBuilderFactory</code></td>
+ </tr>
+ <tr>
+ <td><code>javax.xml.parsers.SAXParserFactory</code></td>
+ <td><code>org.apache.commons.xml.SecureSAXParserFactory</code></td>
+ </tr>
+ <tr>
+ <td><code>javax.xml.validation.SchemaFactory</code></td>
+ <td><code>org.apache.commons.xml.SecureSchemaFactory</code></td>
+ </tr>
+ <tr>
+ <td><code>javax.xml.transform.TransformerFactory</code></td>
+ <td><code>org.apache.commons.xml.SecureTransformerFactory</code></td>
+ </tr>
+ <tr>
+ <td><code>javax.xml.stream.XMLInputFactory</code></td>
+ <td><code>org.apache.commons.xml.SecureXMLInputFactory</code></td>
+ </tr>
+ <tr>
+ <td><code>javax.xml.xpath.XPathFactory</code></td>
+ <td><code>org.apache.commons.xml.SecureXPathFactory</code></td>
+ </tr>
+ </table>
+ <p>
+ Or use the <a href="org/apache/commons/xml/doc-files/rewrite.yml">OpenRewrite recipe</a>.
+ </p>
+ </section>
<section id="why">
<h1>
<img src="org/apache/commons/xml/doc-files/leaf.svg" style="height: 1em; padding-right: 0.25em" alt="leaf">Why
diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md
index ed23283..1826083 100644
--- a/src/site/markdown/index.md
+++ b/src/site/markdown/index.md
@@ -24,6 +24,7 @@ stock JDK and external JAXP implementations.
Full documentation is provided in:
-- [Javadoc Overview](apidocs/index.html),
-- [Javadoc Package Summary](apidocs/org/apache/commons/xml/package-summary.html), and
-- [Project Reports](project-reports.html).
+- [**TL;DR**](apidocs/index.html#tldr)
+- [Javadoc Overview](apidocs/index.html)
+- [Javadoc Package Summary](apidocs/org/apache/commons/xml/package-summary.html)
+- [Project Reports](project-reports.html)