You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by gg...@apache.org on 2026/08/28 17:26:28 UTC
(commons-xml) 11/20: Rename HardeningTransformerFactory to SecureTransformerFactory.
This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit a64a7eedd94c85874bc70d33a364866856e7f3d7
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Fri Aug 28 13:20:10 2026 -0400
Rename HardeningTransformerFactory to SecureTransformerFactory.
Local build OK.
---
.../apache/commons/xml/HardeningXPathFactory.java | 2 +-
.../java/org/apache/commons/xml/SaxonProvider.java | 4 ++--
...merFactory.java => SecureTransformerFactory.java} | 6 +++---
src/site/markdown/index.md | 2 +-
.../apache/commons/xml/AssociatedStylesheetTest.java | 2 +-
.../org/apache/commons/xml/AttackTestSupport.java | 20 ++++++++++----------
.../apache/commons/xml/EntityResolverFloorTest.java | 2 +-
.../commons/xml/HardeningFactoriesSmokeTest.java | 10 +++++-----
.../commons/xml/OverrideDefaultParserTest.java | 4 ++--
.../org/apache/commons/xml/ResetHardeningTest.java | 2 +-
.../apache/commons/xml/SaxSurfaceTestSupport.java | 2 +-
.../commons/xml/SaxonAlternateFactoryTest.java | 2 +-
.../org/apache/commons/xml/ShadingFootprintTest.java | 10 +++++-----
.../apache/commons/xml/XMLFilterParseStringTest.java | 2 +-
14 files changed, 35 insertions(+), 35 deletions(-)
diff --git a/src/main/java/org/apache/commons/xml/HardeningXPathFactory.java b/src/main/java/org/apache/commons/xml/HardeningXPathFactory.java
index be13953..022e487 100644
--- a/src/main/java/org/apache/commons/xml/HardeningXPathFactory.java
+++ b/src/main/java/org/apache/commons/xml/HardeningXPathFactory.java
@@ -63,7 +63,7 @@ public final class HardeningXPathFactory {
* <li><strong>Saxon</strong> ({@code net.sf.saxon}): recognized by package prefix and handed to {@link SaxonProvider#configure(XPathFactory)}, so any public
* subclass routes to the same recipe as the registered factory. Its URI-fetching
* functions and reflection-based extension calls are reachable only through a locked-down Saxon {@code Configuration}, not the standard JAXP knobs; this
- * is the XPath counterpart of the Saxon exception in {@link HardeningTransformerFactory#harden(javax.xml.transform.TransformerFactory)}, kept as a
+ * is the XPath counterpart of the Saxon exception in {@link SecureTransformerFactory#harden(javax.xml.transform.TransformerFactory)}, kept as a
* documented package-prefix exception because the required hardening surface is reachable only through a vendor API.</li>
* <li><strong>FSP</strong> ({@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING}): required. It is the only knob both the stock JDK and Xalan XPath
* engines expose, and switches on their secure-processing limits. {@link XPathFactory} has no attribute API for finer control.</li>
diff --git a/src/main/java/org/apache/commons/xml/SaxonProvider.java b/src/main/java/org/apache/commons/xml/SaxonProvider.java
index 757b807..332ad41 100644
--- a/src/main/java/org/apache/commons/xml/SaxonProvider.java
+++ b/src/main/java/org/apache/commons/xml/SaxonProvider.java
@@ -47,7 +47,7 @@ final class SaxonProvider {
* A Saxon {@link Configuration} carrying the vendor-specific restrictions that the standard JAXP knobs cannot express.
*
* <p>The ignore-all {@link javax.xml.transform.URIResolver} floor is not one of them: it is installed from outside by the shared
- * {@link HardeningTransformerFactory} wrapper (TrAX) or on the Configuration for the XPath path (see {@link SaxonProviderConfigurer#configure(XPathFactory)}),
+ * {@link SecureTransformerFactory} wrapper (TrAX) or on the Configuration for the XPath path (see {@link SaxonProviderConfigurer#configure(XPathFactory)}),
* so both cases reuse {@link FallbackIgnoreURIResolver}. What remains here is Saxon-only:</p>
*
* <ol>
@@ -103,7 +103,7 @@ public XMLReader makeParser(final String className) throws TransformerFactoryCon
private static final class SaxonProviderConfigurer {
private static TransformerFactory configure(final TransformerFactory factory) {
- // The URIResolver floor is installed by the HardeningTransformerFactory wrapper that HardeningTransformerFactory.harden puts around this factory.
+ // The URIResolver floor is installed by the SecureTransformerFactory wrapper that SecureTransformerFactory.harden puts around this factory.
((SaxonTransformerFactory) factory).setConfiguration(new HardenedConfiguration());
return factory;
}
diff --git a/src/main/java/org/apache/commons/xml/HardeningTransformerFactory.java b/src/main/java/org/apache/commons/xml/SecureTransformerFactory.java
similarity index 99%
rename from src/main/java/org/apache/commons/xml/HardeningTransformerFactory.java
rename to src/main/java/org/apache/commons/xml/SecureTransformerFactory.java
index 31f1a0c..7245416 100644
--- a/src/main/java/org/apache/commons/xml/HardeningTransformerFactory.java
+++ b/src/main/java/org/apache/commons/xml/SecureTransformerFactory.java
@@ -74,7 +74,7 @@
*
* @see org.apache.commons.xml
*/
-public final class HardeningTransformerFactory {
+public final class SecureTransformerFactory {
/** Class name of the JDK's built-in default implementation, the Java 8 fallback for {@link #newDefaultInstance()}. */
private static final String JDK_TRANSFORMER_FACTORY = "com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl";
@@ -180,7 +180,7 @@ private static void setFeature(final TransformerFactory factory, final String fe
}
}
- private HardeningTransformerFactory() {
+ private SecureTransformerFactory() {
// static only
}
@@ -194,7 +194,7 @@ private HardeningTransformerFactory() {
*
* <p>Three layers cooperate:</p>
* <ol>
- * <li>{@link HardeningTransformerFactory} rewrites the Source on every entry point that compiles a stylesheet or transforms a one-shot input.</li>
+ * <li>{@link SecureTransformerFactory} rewrites the Source on every entry point that compiles a stylesheet or transforms a one-shot input.</li>
* <li>{@link SecureTemplates} returns a {@link SecureTransformer} from {@link Templates#newTransformer()} so runtime source parsing is also covered, and
* restores the factory's URIResolver onto the produced Transformer (which the underlying implementation typically does not propagate through
* {@code Templates}).</li>
diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md
index ccf71dc..630ea36 100644
--- a/src/site/markdown/index.md
+++ b/src/site/markdown/index.md
@@ -114,7 +114,7 @@ XMLStreamReader reader = HardeningXMLInputFactory.newInstance().createXMLStreamR
```java
import javax.xml.transform.stream.StreamSource;
import javax.xml.transform.stream.StreamResult;
-import org.apache.commons.xml.HardeningTransformerFactory;
+import org.apache.commons.xml.SecureTransformerFactory;
HardeningTransformerFactory.newInstance()
.newTransformer(new StreamSource(stylesheet))
diff --git a/src/test/java/org/apache/commons/xml/AssociatedStylesheetTest.java b/src/test/java/org/apache/commons/xml/AssociatedStylesheetTest.java
index 4976ed9..4df4615 100644
--- a/src/test/java/org/apache/commons/xml/AssociatedStylesheetTest.java
+++ b/src/test/java/org/apache/commons/xml/AssociatedStylesheetTest.java
@@ -50,7 +50,7 @@ private static void assertAssociatedStylesheet(final Source associated) {
}
private static TransformerFactory hardenedFactory() {
- final TransformerFactory factory = HardeningTransformerFactory.newInstance();
+ final TransformerFactory factory = SecureTransformerFactory.newInstance();
factory.setErrorListener(AttackTestSupport.STRICT_REPORTER);
return factory;
}
diff --git a/src/test/java/org/apache/commons/xml/AttackTestSupport.java b/src/test/java/org/apache/commons/xml/AttackTestSupport.java
index fdf7755..8ed003a 100644
--- a/src/test/java/org/apache/commons/xml/AttackTestSupport.java
+++ b/src/test/java/org/apache/commons/xml/AttackTestSupport.java
@@ -560,12 +560,12 @@ static void assertStaxParses(final String payload) {
/**
* Asserts a hardened Templates compile-and-transform throws.
*
- * <p>{@link TransformerFactory#newTemplates(Source)} via {@link HardeningTransformerFactory#newInstance()} followed by transform; either step throwing
+ * <p>{@link TransformerFactory#newTemplates(Source)} via {@link SecureTransformerFactory#newInstance()} followed by transform; either step throwing
* passes.</p>
*/
static void assertTemplatesBlocks(final Source xslt) {
assertParseFails(() -> {
- final Templates templates = strictTemplates(HardeningTransformerFactory.newInstance(), xslt);
+ final Templates templates = strictTemplates(SecureTransformerFactory.newInstance(), xslt);
// Xalan returns `null` if the template fails
if (templates == null) {
throw new TransformerException("Transformer factory returned null");
@@ -584,7 +584,7 @@ static void assertTemplatesBlocksOrDoesNotLeak(final Source xslt) {
/**
* Asserts a hardened Templates compile-and-transform succeeds.
*
- * <p>{@link TransformerFactory#newTemplates(Source)} via {@link HardeningTransformerFactory#newInstance()} followed by transform; positive control for
+ * <p>{@link TransformerFactory#newTemplates(Source)} via {@link SecureTransformerFactory#newInstance()} followed by transform; positive control for
* DOCTYPE-only payloads.</p>
*/
static void assertTemplatesCompiles(final Source xslt) {
@@ -594,7 +594,7 @@ static void assertTemplatesCompiles(final Source xslt) {
/**
* Asserts a hardened Templates compile-and-transform completes without throwing and without leaked content.
*
- * <p>{@link TransformerFactory#newTemplates(Source)} via {@link HardeningTransformerFactory#newInstance()} followed by transform; use this when the hardening
+ * <p>{@link TransformerFactory#newTemplates(Source)} via {@link SecureTransformerFactory#newInstance()} followed by transform; use this when the hardening
* contract guarantees the compile and transform succeed but never resolve the external resource.</p>
*/
static void assertTemplatesDoesNotLeak(final Source xslt) {
@@ -604,12 +604,12 @@ static void assertTemplatesDoesNotLeak(final Source xslt) {
/**
* Asserts a hardened identity Transformer of the payload throws.
*
- * <p>{@link Transformer#transform(Source, javax.xml.transform.Result)} on the identity transformer from {@link HardeningTransformerFactory#newInstance()}; only
+ * <p>{@link Transformer#transform(Source, javax.xml.transform.Result)} on the identity transformer from {@link SecureTransformerFactory#newInstance()}; only
* a thrown exception passes.</p>
*/
static void assertTransformerBlocks(final String payload) {
assertParseFails(
- () -> strictTransformer(HardeningTransformerFactory.newInstance()).transform(streamSource(payload), new StreamResult(new StringWriter())),
+ () -> strictTransformer(SecureTransformerFactory.newInstance()).transform(streamSource(payload), new StreamResult(new StringWriter())),
"Transformer", TransformerException.class);
}
@@ -623,7 +623,7 @@ static void assertTransformerBlocksOrDoesNotLeak(final String payload) {
/**
* Asserts a hardened identity Transformer completes without throwing and without leaked content.
*
- * <p>{@link Transformer#transform(Source, javax.xml.transform.Result)} via {@link HardeningTransformerFactory#newInstance()}; use this when the hardening
+ * <p>{@link Transformer#transform(Source, javax.xml.transform.Result)} via {@link SecureTransformerFactory#newInstance()}; use this when the hardening
* contract guarantees the transform succeeds but never resolves the external resource.</p>
*/
static void assertTransformerDoesNotLeak(final String payload) {
@@ -633,7 +633,7 @@ static void assertTransformerDoesNotLeak(final String payload) {
/**
* Asserts a hardened identity Transformer succeeds.
*
- * <p>{@link Transformer#transform(Source, javax.xml.transform.Result)} on the identity transformer from {@link HardeningTransformerFactory#newInstance()};
+ * <p>{@link Transformer#transform(Source, javax.xml.transform.Result)} on the identity transformer from {@link SecureTransformerFactory#newInstance()};
* positive control for DOCTYPE-only payloads.</p>
*/
static void assertTransformerTransforms(final String payload) {
@@ -845,7 +845,7 @@ private static String domParseAndCaptureText(final String payload) throws Except
private static String identityTransformAndCapture(final String payload) throws TransformerException {
final StringWriter sink = new StringWriter();
- strictTransformer(HardeningTransformerFactory.newInstance()).transform(streamSource(payload), new StreamResult(sink));
+ strictTransformer(SecureTransformerFactory.newInstance()).transform(streamSource(payload), new StreamResult(sink));
return sink.toString();
}
@@ -1042,7 +1042,7 @@ private static void suppressException(final Executable action) {
private static String templatesCompileAndTransform(final Source xslt) throws TransformerException {
final StringWriter sink = new StringWriter();
- final Templates templates = strictTemplates(HardeningTransformerFactory.newInstance(), xslt);
+ final Templates templates = strictTemplates(SecureTransformerFactory.newInstance(), xslt);
// Xalan returns `null` if the template fails
if (templates != null) {
strictTransformer(templates).transform(streamSource("<root/>"), new StreamResult(sink));
diff --git a/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java b/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java
index bd103b7..9ad9eb2 100644
--- a/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java
+++ b/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java
@@ -144,7 +144,7 @@ private static XMLReader hardenedReader() throws Exception {
* implementation cannot quietly recover from a floor resolution while the test asserts clean completion.
*/
private static TransformerFactory hardenedTransformerFactory() {
- final TransformerFactory factory = HardeningTransformerFactory.newInstance();
+ final TransformerFactory factory = SecureTransformerFactory.newInstance();
factory.setErrorListener(AttackTestSupport.STRICT_REPORTER);
return factory;
}
diff --git a/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java b/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java
index 97bc1ab..5ee7a26 100644
--- a/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java
+++ b/src/test/java/org/apache/commons/xml/HardeningFactoriesSmokeTest.java
@@ -61,7 +61,7 @@ void publicClassesDoNotExtendTheirJaxpFactoryType() {
assertFalse(DocumentBuilderFactory.class.isAssignableFrom(SecureDocumentBuilderFactory.class));
assertFalse(SAXParserFactory.class.isAssignableFrom(SecureSAXParserFactory.class));
assertFalse(SchemaFactory.class.isAssignableFrom(SecureSchemaFactory.class));
- assertFalse(TransformerFactory.class.isAssignableFrom(HardeningTransformerFactory.class));
+ assertFalse(TransformerFactory.class.isAssignableFrom(SecureTransformerFactory.class));
assertFalse(XMLInputFactory.class.isAssignableFrom(HardeningXMLInputFactory.class));
assertFalse(XPathFactory.class.isAssignableFrom(HardeningXPathFactory.class));
}
@@ -114,8 +114,8 @@ void newSchemaFactoryReturnsFreshInstance() throws Exception {
@Test
void newTransformerFactoryReturnsFreshInstance() {
- final TransformerFactory a = HardeningTransformerFactory.newInstance();
- final TransformerFactory b = HardeningTransformerFactory.newInstance();
+ final TransformerFactory a = SecureTransformerFactory.newInstance();
+ final TransformerFactory b = SecureTransformerFactory.newInstance();
assertNotSame(a, b);
}
@@ -162,7 +162,7 @@ void explicitClassNameSchemaFactoryIsHardened() throws Exception {
@Test
void explicitClassNameTransformerFactoryIsHardened() {
final Class<?> impl = TransformerFactory.newInstance().getClass();
- final TransformerFactory factory = HardeningTransformerFactory.newInstance(impl.getName(), impl.getClassLoader());
+ final TransformerFactory factory = SecureTransformerFactory.newInstance(impl.getName(), impl.getClassLoader());
assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING));
}
@@ -298,7 +298,7 @@ void newDefaultInstanceSchemaFactoryIsHardened() throws Exception {
@Test
void newDefaultInstanceTransformerFactoryIsHardened() {
- final TransformerFactory factory = HardeningTransformerFactory.newDefaultInstance();
+ final TransformerFactory factory = SecureTransformerFactory.newDefaultInstance();
assertTrue(factory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING));
}
diff --git a/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java b/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java
index cada97c..4dedd9a 100644
--- a/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java
+++ b/src/test/java/org/apache/commons/xml/OverrideDefaultParserTest.java
@@ -88,7 +88,7 @@ void schemaFactoryReadsFeatureAtCreation() throws Exception {
@Test
void transformerFactoryReadsFeatureAtCreation() throws Exception {
assumeFalse(AttackTestSupport.IS_ANDROID);
- final TransformerFactory factory = HardeningTransformerFactory.newDefaultInstance();
+ final TransformerFactory factory = SecureTransformerFactory.newDefaultInstance();
assertFalse(factory.getFeature(FEATURE));
assertFalse(((SecureTemplates) factory.newTemplates(AttackTestSupport.streamSource(AttackTestSupport.xsltBody("probe")))).overrideDefaultParser);
factory.setFeature(FEATURE, true);
@@ -101,7 +101,7 @@ void transformerFactoryReadsFeatureAtCreation() throws Exception {
@DisabledInNativeImage
void transformSucceedsUnderBothParserFamilies() throws Exception {
assumeFalse(AttackTestSupport.IS_ANDROID);
- final TransformerFactory factory = HardeningTransformerFactory.newDefaultInstance();
+ final TransformerFactory factory = SecureTransformerFactory.newDefaultInstance();
// Feature false (the JDK's default): stylesheet and source parse through the pinned platform parser.
assertTrue(transform(factory, "pinned").contains("pinned"));
factory.setFeature(FEATURE, true);
diff --git a/src/test/java/org/apache/commons/xml/ResetHardeningTest.java b/src/test/java/org/apache/commons/xml/ResetHardeningTest.java
index bcdccb4..3945379 100644
--- a/src/test/java/org/apache/commons/xml/ResetHardeningTest.java
+++ b/src/test/java/org/apache/commons/xml/ResetHardeningTest.java
@@ -90,7 +90,7 @@ void saxParserResetKeepsEntityResolverFloor() throws Exception {
@Tag("trax")
void transformerResetKeepsUriResolverFloor() throws Exception {
// with-document.xsl copies document('referenced.xml') into the output at transform time, so a transformer whose floor was stripped leaks the marker.
- final Transformer transformer = HardeningTransformerFactory.newInstance()
+ final Transformer transformer = SecureTransformerFactory.newInstance()
.newTemplates(AttackTestSupport.resourceSource("with-document.xsl")).newTransformer();
AttackTestSupport.assumeDoesNotThrow(transformer::reset);
final StringWriter sink = new StringWriter();
diff --git a/src/test/java/org/apache/commons/xml/SaxSurfaceTestSupport.java b/src/test/java/org/apache/commons/xml/SaxSurfaceTestSupport.java
index 2ab2401..59929b9 100644
--- a/src/test/java/org/apache/commons/xml/SaxSurfaceTestSupport.java
+++ b/src/test/java/org/apache/commons/xml/SaxSurfaceTestSupport.java
@@ -49,7 +49,7 @@ static void feed(final ContentHandler handler, final InputSource input) throws E
/** The hardened factory, as its runtime {@link SAXTransformerFactory} type. */
static SAXTransformerFactory hardenedFactory() {
- return (SAXTransformerFactory) HardeningTransformerFactory.newInstance();
+ return (SAXTransformerFactory) SecureTransformerFactory.newInstance();
}
/** Opens a fixture under {@code leaked/} as an {@link InputSource} preserving its system id, so relative hrefs resolve normally. */
diff --git a/src/test/java/org/apache/commons/xml/SaxonAlternateFactoryTest.java b/src/test/java/org/apache/commons/xml/SaxonAlternateFactoryTest.java
index 475cfd0..03094f7 100644
--- a/src/test/java/org/apache/commons/xml/SaxonAlternateFactoryTest.java
+++ b/src/test/java/org/apache/commons/xml/SaxonAlternateFactoryTest.java
@@ -87,7 +87,7 @@ private static String transform(final TransformerFactory factory) throws Transfo
void hardenedBasicFactoryDoesNotLeakCollection() {
assumeSaxonPresent();
try {
- final String result = transform(HardeningTransformerFactory.harden(basicSaxonFactory()));
+ final String result = transform(SecureTransformerFactory.harden(basicSaxonFactory()));
assertFalse(result.contains(AttackTestSupport.LEAKED_MARKER), "collection() leaked through the alternate Saxon factory:\n" + result);
} catch (final TransformerException blocked) {
// Throwing is an acceptable outcome since it also prevents leaking the marker.
diff --git a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java
index 372c8d0..1c614e2 100644
--- a/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java
+++ b/src/test/java/org/apache/commons/xml/ShadingFootprintTest.java
@@ -111,9 +111,9 @@ class ShadingFootprintTest {
"SecureTemplates",
"SecureTemplatesHandler",
"SecureTransformer",
- "HardeningTransformerFactory",
- "HardeningTransformerFactory$1",
- "HardeningTransformerFactory$Wrapper",
+ "SecureTransformerFactory",
+ "SecureTransformerFactory$1",
+ "SecureTransformerFactory$Wrapper",
"HardeningTransformerHandler",
"HardeningXMLFilter",
"HardeningXMLReader",
@@ -178,7 +178,7 @@ class ShadingFootprintTest {
* Entry points reported by the {@link #reportFootprint()} diagnostic, most-focused first, ending with the whole library.
*/
private static final String[] REPORTED = {"SecureDocumentBuilderFactory", "SecureSAXParserFactory", "HardeningXMLInputFactory",
- "HardeningTransformerFactory", "HardeningXPathFactory", "SecureSchemaFactory"};
+ "SecureTransformerFactory", "HardeningXPathFactory", "SecureSchemaFactory"};
private static Clazzpath clazzpath;
private static Path classesDir;
@@ -289,7 +289,7 @@ void xmlInputFactoryFootprint() {
@Test
void transformerFactoryFootprint() {
- assertEquals(TRANSFORMER_FACTORY, closureOf("HardeningTransformerFactory"));
+ assertEquals(TRANSFORMER_FACTORY, closureOf("SecureTransformerFactory"));
}
@Test
diff --git a/src/test/java/org/apache/commons/xml/XMLFilterParseStringTest.java b/src/test/java/org/apache/commons/xml/XMLFilterParseStringTest.java
index 8b0b98b..0620349 100644
--- a/src/test/java/org/apache/commons/xml/XMLFilterParseStringTest.java
+++ b/src/test/java/org/apache/commons/xml/XMLFilterParseStringTest.java
@@ -53,7 +53,7 @@ private static String entityPayload() {
@Test
void hardenedFilterParseStringDoesNotLeakExternalEntity(@TempDir final Path tmpDir) throws Exception {
- final SAXTransformerFactory factory = (SAXTransformerFactory) HardeningTransformerFactory.newInstance();
+ final SAXTransformerFactory factory = (SAXTransformerFactory) SecureTransformerFactory.newInstance();
final Templates templates = factory.newTemplates(new StreamSource(new StringReader(IDENTITY_XSLT)));
final XMLFilter filter = factory.newXMLFilter(templates);
final Path tmp = Files.createTempFile(tmpDir, "xmlfilter", ".xml");