ppkarwasz opened a new pull request, #66: URL: https://github.com/apache/commons-secure-xml/pull/66
Adds a **Honored JAXP contracts** subsection to *Assumptions about the environment* in the threat model, making explicit an assumption the securing recipes already rely on: - a method handed a `SAXSource` carrying an `XMLReader` parses with that reader, as the `SAXSource` contract requires; - a method handed a `StAXSource` reads from the stream or event reader it carries, as the `StAXSource` contract implies (the reader must arrive positioned on `START_DOCUMENT` or `START_ELEMENT`, and the source is consumed during processing). An implementation that ignores the supplied reader and parses with an internal parser of its own parses outside the securing; guarding against that would be a valid hardening, but the substitution is a contract violation in that implementation, not a vulnerability here — such a report is triaged `OUT-OF-SCOPE: foreign implementation`. Also bumps the modeled release line to **1.0.x**. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
