Re: [PR] Sharpen the threat model: honored JAXP contracts, XInclude, and expansion limits [commons-secure-xml]

["garydgregory (via GitHub)" <gi...@apache.org>]

garydgregory commented on code in PR #66:
URL: https://github.com/apache/commons-secure-xml/pull/66#discussion_r3905215335


##########
src/site/markdown/threat_model.md:
##########
@@ -132,12 +174,16 @@ JDK version and the standard `jdk.xml.*` limit properties the JDK itself reads:
   default `2500` on JDK 25 and `64000` on JDK 8 through 21). These are trusted deployment configuration: an operator may
   set one to tighten (or loosen) a limit globally, but loosening through one is reconfiguration, treated like loosening
   any other reserved setting (see [What is out of scope](#what-is-out-of-scope)).
-- The bundled parsers apply their own hardcoded secure defaults instead (for example external Xerces and Woodstox cap
-  entity expansion at `100000`) and do not read `jdk.xml.*`.
+- The bundled parsers apply their own hardcoded secure defaults instead

Review Comment:
   We don't bundle any parsers with the library, so what does "bundle" mean here? Please specify if these are the parsers we depend on at test-time. Or the parsers bundled in a JRE or JDK? Or something else?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org