ppkarwasz opened a new pull request, #71: URL: https://github.com/apache/commons-secure-xml/pull/71
Saxon's XPath 3.1 `unparsed-text`, `unparsed-text-lines`, `unparsed-text-available` and `json-doc` do not go through the JAXP `URIResolver` that governs `document()` and `xsl:include`/`xsl:import`: Saxon routes them through the `Configuration`'s resource resolver. `SaxonXPathExternalCallsTest` covers that chain on the XPath path, where the floor sits on the `Configuration` directly, but the stylesheet side had no equivalent — the TrAX path installs its floor through the factory wrapper's `setURIResolver`, and nothing verified that the two routes meet. They do. This adds the TrAX companion test, and no production change is needed: - **`unparsed-text`, `unparsed-text-lines`, `json-doc`** — checked as leak pairs. An unconfigured Saxon factory resolves the URI and copies the marker into the transform output (control, proving the vector is real); the secured factory does not. Saxon reports `FOUT1170 Resolver for unparsed-text() returned non-StreamSource`, i.e. the floor *is* consulted for the text-nature request and answers with `EmptySource`. - **`unparsed-text-available`** — discloses no content, so it is checked as an existence oracle: the unconfigured factory distinguishes an existing fixture from a missing sibling, and the secured factory must not. Saxon is instantiated reflectively behind an `assumeSaxonPresent()` guard, following `SaxonAlternateFactoryTest`, so the class is effective on the `test-saxon` and `test-saxon-xerces` executions (7 run, 0 failures) and skips on the four executions without Saxon. Full matrix green. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
