Skip to content

Improve XMLUtil and usage#9488

Open
mbien wants to merge 3 commits into
apache:masterfrom
mbien:explicit-sp
Open

Improve XMLUtil and usage#9488
mbien wants to merge 3 commits into
apache:masterfrom
mbien:explicit-sp

Conversation

@mbien

@mbien mbien commented Jul 6, 2026

Copy link
Copy Markdown
Member

Some cleanup around XML factories

@mbien mbien added ci:all-tests [ci] enable all tests Code cleanup Label for cleanup done on the Netbeans IDE labels Jul 6, 2026
@matthiasblaesing

Copy link
Copy Markdown
Contributor

I noticed after looking through this, that it is marked draft, but the intention looks sane to me and I would expect that the changed code paths will still work ("creative" entity usage is not something I expect in a build script for example). Thanks!

mbien added 3 commits July 11, 2026 17:19
Setting it to true by default would break compatibility, the existing
parse methods will set the parameter to false (effectively leaving it
unset, see below).

'getDOMImplementation()' and 'normalize()' will set it to true now.

note regarding FEATURE_SECURE_PROCESSING:

It is a tri-state boolean and can be implicit true, explicit true and
explicit false. JDK 11+ has it on implicit true by default.

Implicit true and explicit true are not the same, explicit true enables
additional limits and checks, e.g it will throw on external entity
loading attempts. (unless the external entity feature was disabled by
other means, in which case it would simply ignore external entities)

That is also why passing false as parameter to the new methods will
leave it at its default value instead of turning it completely off.
(it remains at implicit true)
@mbien mbien added the ci:dev-build [ci] produce a dev-build zip artifact (7 days expiration, see link on workflow summary page) label Jul 11, 2026
@mbien mbien added this to the NB31 milestone Jul 11, 2026
@mbien mbien marked this pull request as ready for review July 11, 2026 23:15
@mbien

mbien commented Jul 12, 2026

Copy link
Copy Markdown
Member Author

added a commit and rebased, rest remained unchanged.

@matthiasblaesing matthiasblaesing left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This make sense to me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci:all-tests [ci] enable all tests ci:dev-build [ci] produce a dev-build zip artifact (7 days expiration, see link on workflow summary page) Code cleanup Label for cleanup done on the Netbeans IDE

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants