You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@xalan.apache.org by Arnout Engelen <en...@apache.org> on 2023/01/19 09:27:03 UTC
Security section for the Xalan website
Hello,
It seems people occasionally don't realize they should expect to take
some precautions before using Xalan on untrusted input. It might be
good to make an explicit note about that on the website, something
like the attached patch?
Of course it would be even better if we could provide (or link to)
in-depth instructions, but until we have something like that I think
just highlighting the fact that this needs people's attention would be
an improvement.
The patch is against https://svn.apache.org/repos/asf/xalan/site/ . I
also took the opportunity of updating some links to https.
Kind regards,
Arnout
Re: Security section for the Xalan website
Posted by Arnout Engelen <en...@apache.org>.
On Thu, Jan 19, 2023 at 3:49 PM Gary Gregory <ga...@gmail.com> wrote:
> I'm worried these changes will just be overwritten when we publish the site for the upcoming 2.7.3 version. The changes should be done to the site sources in the git repo.
Ha, sorry, missed that somehow... I assume that'd be
https://github.com/apache/xalan-site/pull/1 ?
Kind regards,
Arnout
> On Thu, Jan 19, 2023, 04:27 Arnout Engelen <en...@apache.org> wrote:
>>
>> Hello,
>>
>> It seems people occasionally don't realize they should expect to take
>> some precautions before using Xalan on untrusted input. It might be
>> good to make an explicit note about that on the website, something
>> like the attached patch?
>>
>> Of course it would be even better if we could provide (or link to)
>> in-depth instructions, but until we have something like that I think
>> just highlighting the fact that this needs people's attention would be
>> an improvement.
>>
>> The patch is against https://svn.apache.org/repos/asf/xalan/site/ . I
>> also took the opportunity of updating some links to https.
>>
>>
>> Kind regards,
>>
>> Arnout
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
>> For additional commands, e-mail: dev-help@xalan.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
For additional commands, e-mail: dev-help@xalan.apache.org
Re: Security section for the Xalan website
Posted by Mukul Gandhi <mu...@apache.org>.
Hi Gary,
On Thu, Jan 19, 2023 at 8:19 PM Gary Gregory <ga...@gmail.com> wrote:
>
> Thank you very much for the patch :-)
>
> I'm worried these changes will just be overwritten when we publish the site for the upcoming 2.7.3 version. The changes should be done to the site sources in the got repo.
I hope that, you'd at some point, integrate Arnout's XalanJ
documentation patch (perhaps, with your review comments integrated) on
XalanJ's production site.
I also hope that, you could also take kind responsibility to update
XalanJ's production documentation with the documentation changes
that're being done on XalanJ's xalan-java repos (branch
xalan-j_2_7_1_maint) for the XalanJ 2.7.3 release.
--
Regards,
Mukul Gandhi
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
For additional commands, e-mail: dev-help@xalan.apache.org
Re: Security section for the Xalan website
Posted by Mukul Gandhi <mu...@apache.org>.
Hi Gary,
On Thu, Jan 19, 2023 at 8:19 PM Gary Gregory <ga...@gmail.com> wrote:
>
> Hi Arnout, hi Mukul,
>
> Thank you very much for the patch :-)
>
> I'm worried these changes will just be overwritten when we publish the site for the upcoming 2.7.3 version. The changes should be done to the site sources in the got repo.
>
> Mukul,
>
> Can you point Arnout to the right place in git?
Looks like, you're currently reviewing (and should hopefully, be
publishing that as well) Arnout's git PR for the changes to Xalan web
site. Many thanks, for that.
--
Regards,
Mukul Gandhi
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
For additional commands, e-mail: dev-help@xalan.apache.org
Re: Security section for the Xalan website
Posted by Gary Gregory <ga...@gmail.com>.
Hi Arnout, hi Mukul,
Thank you very much for the patch :-)
I'm worried these changes will just be overwritten when we publish the site
for the upcoming 2.7.3 version. The changes should be done to the site
sources in the got repo.
Mukul,
Can you point Arnout to the right place in git?
TY both!
Gary
On Thu, Jan 19, 2023, 04:27 Arnout Engelen <en...@apache.org> wrote:
> Hello,
>
> It seems people occasionally don't realize they should expect to take
> some precautions before using Xalan on untrusted input. It might be
> good to make an explicit note about that on the website, something
> like the attached patch?
>
> Of course it would be even better if we could provide (or link to)
> in-depth instructions, but until we have something like that I think
> just highlighting the fact that this needs people's attention would be
> an improvement.
>
> The patch is against https://svn.apache.org/repos/asf/xalan/site/ . I
> also took the opportunity of updating some links to https.
>
>
> Kind regards,
>
> Arnout
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@xalan.apache.org
> For additional commands, e-mail: dev-help@xalan.apache.org