[jira] [Closed] (CXF-9249) Delegate JAXP parser configuration to Apache Commons Secure XML

["Gary D. Gregory (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CXF-9249?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Gary D. Gregory closed CXF-9249.
--------------------------------
    Resolution: Abandoned

Wrong project, sorry.

> Delegate JAXP parser configuration to Apache Commons Secure XML
> ---------------------------------------------------------------
>
>                 Key: CXF-9249
>                 URL: https://issues.apache.org/jira/browse/CXF-9249
>             Project: CXF
>          Issue Type: Improvement
>            Reporter: Gary D. Gregory
>            Priority: Minor
>
> Tika maintains custom XML security configuration across SAX, DOM, StAX, and XSLT processing. Adopt Apache Commons Secure XML 1.0.0 to centralize these protections and reduce duplicated configuration and resolver code.
> This change:
>  * Uses Commons Secure XML factories in {{{}XMLReaderUtils{}}}, MIME type loading, and XML-related tests.
>  * Removes manual SAX/DOM feature configuration, transformer external-access attributes, and the custom StAX fallback resolver.
>  * Retains Tika’s configurable entity expansion limits, parser pooling, DOM entity-reference settings, and StAX restrictions on DTD and external entity processing.
>  * Routes async configuration writer document and transformer creation through {{{}XMLReaderUtils{}}}.
>  * Adds Maven dependencies and updates the OSGi integration-test setup.
> Regression tests cover external entity blocking and external resource access through XSLT {{{}document(){}}}, {{{}xsl:include{}}}, and {{xsl:import}} for both transformer factory getters. They also verify that explicitly supplied resolvers remain usable and that the async writer can create new XML configurations and preserve existing configuration content.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)