You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@groovy.apache.org by pa...@apache.org on 2026/09/09 02:08:31 UTC
(groovy) branch master updated (2290229014 -> 7add18c8ed)
This is an automated email from the ASF dual-hosted git repository.
paulk-asert pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/groovy.git
from 2290229014 GROOVY-12374: Launchers: match java classpath semantics — no implicit . when -cp is set
new a19221f353 add 5.1.X to SECURITY.md
new 7add18c8ed add 5.1.X to SECURITY.md
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/SECURITY.md | 15 ++++++-----
.../groovy-xml/src/spec/doc/_xml-security.adoc | 30 ++++++++++++++++++++++
2 files changed, 38 insertions(+), 7 deletions(-)
(groovy) 02/02: add 5.1.X to SECURITY.md
Posted by pa...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
paulk-asert pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/groovy.git
commit 7add18c8ed791e698b425c7431f54d5bdea7a751
Author: Paul King <pa...@asert.com.au>
AuthorDate: Wed Sep 9 12:08:21 2026 +1000
add 5.1.X to SECURITY.md
---
.../groovy-xml/src/spec/doc/_xml-security.adoc | 30 ++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/subprojects/groovy-xml/src/spec/doc/_xml-security.adoc b/subprojects/groovy-xml/src/spec/doc/_xml-security.adoc
index 9ebf1e7255..2cd9fe9a72 100644
--- a/subprojects/groovy-xml/src/spec/doc/_xml-security.adoc
+++ b/subprojects/groovy-xml/src/spec/doc/_xml-security.adoc
@@ -211,6 +211,36 @@ try {
provider does not recognise. If you ship a custom JAXP provider that
doesn't implement `FEATURE_SECURE_PROCESSING`, hardening is best-effort
and your factory may fall back to provider defaults.
+* For that narrow case — a non-JDK JAXP provider on the classpath, where you
+ want protection that does not depend on the provider honouring the JAXP
+ feature flags — you can optionally add
+ https://commons.apache.org/proper/commons-secure-xml/[Apache Commons Secure XML]
+ to *your* project (Groovy itself does not depend on it). It installs an
+ implementation-independent floor: external references resolve to empty content
+ on any provider. Compose it with Groovy's APIs by injecting a Commons-secured
+ parser into the constructor:
++
+[source,groovy]
+----
+import org.apache.commons.xml.secure.SecureSAXParserFactory
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory
+
+// SAX-based (XmlParser / XmlSlurper) — Groovy's GPath on top of Commons' floor
+def sp = SecureSAXParserFactory.newInstance().newSAXParser()
+def root = new XmlSlurper(sp).parseText(text)
+
+// DOM-based (DOMBuilder)
+def db = SecureDocumentBuilderFactory.newInstance().newDocumentBuilder()
+def dom = new DOMBuilder(db)
+----
++
+This is defence-in-depth for a small residual: on the stock JDK, Groovy's own
+defaults already block XXE, entity expansion and external resource access, so
+no extra dependency is needed. Two caveats: injection applies only to parsers
+you construct explicitly (the convenience entry points such as `new XmlParser()`
+and `XmlUtil.*` keep using Groovy's own hardened factories), and it bypasses
+Groovy's factory configuration — so set `jdk.xml.maxElementDepth` on the injected
+parser yourself if you also want Groovy's element-depth bound.
* `SchemaFactory` instances returned by `FactorySupport.createSchemaFactory`
enable `FEATURE_SECURE_PROCESSING` but do *not* set `ACCESS_EXTERNAL_SCHEMA`.
This preserves the ability to resolve `<xs:import schemaLocation="...">`
(groovy) 01/02: add 5.1.X to SECURITY.md
Posted by pa...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
paulk-asert pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/groovy.git
commit a19221f353590c6a0cb42ff169a42d086e6e19bb
Author: Paul King <pa...@asert.com.au>
AuthorDate: Wed Sep 9 12:07:56 2026 +1000
add 5.1.X to SECURITY.md
---
.github/SECURITY.md | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index 6d1ee2ddf5..17910d838f 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -18,7 +18,7 @@ limitations under the License.
## Supported Versions
-The latest released version in the Groovy 5.0.x stream of releases
+The latest released version in the Groovy 5.1.x stream of releases
is the currently recommended version of Groovy and requires JDK11 as a minimum.
Users still working on JDK 8 should use the latest 4.0.x version.
@@ -33,13 +33,14 @@ were renamed due to split package remediation ([GROOVY-10542](https://issues.apa
| 2.5.x | :x: | |
| 3.0.x | :white_check_mark: | Reduced releases on this branch (\*) |
| 4.0.x | :white_check_mark: | |
-| 5.0.x | :white_check_mark: | |
-| 6.0.x | :grey_question: | Beta releases status (**) |
+| 5.0.x | :white_check_mark: | Previous stable stream |
+| 5.1.x | :white_check_mark: | Currently recommended stable |
+| 6.0.x | :grey_question: | RC releases status (**) |
(\*) The 3.0.x stream is no longer the focus of the core team,
but we are currently still doing critical security fixes if needed.
-(**) While in early stages of pre-release, security fixes are
+(**) While in pre-release, security fixes are
done on a best-effort basis.
`@Incubating` APIs carry reduced-priority status for security fixes.
@@ -98,9 +99,9 @@ Software Foundation's central security address). You may also, or
instead, write to the Apache Groovy PMC's private list,
**private@groovy.apache.org**.
-Apache Groovy follows the Apache
-[general guidelines for handling security vulnerabilities](http://www.apache.org/security/committers.html)
-and the [ASF security process](https://www.apache.org/security/).
+Apache Groovy follows the ASF's foundation-wide
+[vulnerability reporting process](https://security.apache.org/report/); see also
+the [general guidelines for handling security vulnerabilities](http://www.apache.org/security/committers.html).
## Disclosure hygiene for contributors