You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by gg...@apache.org on 2026/10/05 21:49:36 UTC
svn commit: r1938811 - commons/cms-site/trunk/content/markdown
Author: ggregory
Date: Mon Oct 5 21:49:36 2026
New Revision: 1938811
Log:
Update threat model per discussion on the ML https://lists.apache.org/thread.html/tckwj80shttndvnftoltk6g3fz2nrmcn
Modified:
commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md
Modified: commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md
==============================================================================
--- commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md Mon Oct 5 20:10:04 2026 (r1938810)
+++ commons/cms-site/trunk/content/markdown/threat-model-0.1.0.md Mon Oct 5 21:49:36 2026 (r1938811)
@@ -334,11 +334,8 @@ the family does not take on an adversary
Commons accepts input only through public API parameters.
**The exception, a narrow default-configuration promise:**
-for **Compress, Configuration, Text, and FileUpload**,
-passing any data to them in their default configuration will not:
+Components will not:
-- cause excessive CPU consumption,
-- cause excessive memory allocation,
- execute remote code.
This promise covers availability and integrity only.