ppkarwasz opened a new pull request, #68: URL: https://github.com/apache/commons-secure-xml/pull/68
`FallbackIgnoreEntityResolver2` inherited `DefaultHandler2`'s always-`null` `getExternalSubset`, so a caller resolver installed through `setEntityResolver` never had its synthetic external subset consulted: DOCTYPE-less documents parsed without the declarations the caller's `EntityResolver2` supplied, silently diverging from the "caller's resolver is consulted first" contract. The fix forwards `getExternalSubset` to an `EntityResolver2` delegate; with no delegate (or a plain `EntityResolver`) the "no synthetic subset" default stands. The ignore fallback deliberately stays out of this path: a `null` return means the parse continues without a subset — nothing is fetched — not that a resource went unresolved, so flooring it would wrongly synthesize an empty subset (and reject DOCTYPE-less documents under `throwOnUnresolved`). Delegation coverage is tested in `FallbackIgnoreEntityResolver2Test` for all three delegate shapes (none, plain `EntityResolver`, `EntityResolver2`). No `changes.xml` entry: the fix lands in the same release cycle that introduces the class. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
