)]}'
{
  "commit": "42fdc81734aa1059eeef8c35c72ac9958feef773",
  "tree": "f9fa93be46fc2358a246506c502d3094c1168741",
  "parents": [
    "515c4bc76e0f74ab484100d56e0d07290c3983c9"
  ],
  "author": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Thu Sep 03 05:14:11 2026 -1000"
  },
  "committer": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Thu Sep 03 05:14:11 2026 -1000"
  },
  "message": "Do not trust the schema the schema compiler is compiling\n\nXSD2Java and its maven plugin exist to consume contracts written elsewhere, yet\nparsed them with a bare DocumentBuilderFactory and let xs:include/xs:import\ndereference whatever scheme the location named: a schema handed to a developer\ncould read local files, exfiltrate them through an external entity, or make the\nbuild fetch internal URLs. DOCTYPE and external entities are refused now, and\nlocations resolve from the filesystem only unless -asl says otherwise. The check\nis on the location after resolution against the base, since a relative include\nunder a remote base is remote too.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "cb4294f7e9f574ee1844ca87ece09a2c475d8a3f",
      "new_mode": 33188,
      "new_path": "modules/adb-codegen/src/org/apache/axis2/schema/RestrictedSchemaURIResolver.java"
    },
    {
      "type": "modify",
      "old_id": "b5841ff216c5f0bb884cdca58713b0a7bc98c6e9",
      "old_mode": 33188,
      "old_path": "modules/adb-codegen/src/org/apache/axis2/schema/XSD2Java.java",
      "new_id": "c7ec26fada8eaa53023cbfc63b06ab54e25b73b9",
      "new_mode": 33188,
      "new_path": "modules/adb-codegen/src/org/apache/axis2/schema/XSD2Java.java"
    },
    {
      "type": "modify",
      "old_id": "5564ac0c06c20f35bf1c4b3aa26a1619aab14b90",
      "old_mode": 33188,
      "old_path": "modules/adb-codegen/src/org/apache/axis2/schema/i18n/resource.properties",
      "new_id": "6530d8dedf4f1ee6291969072fde5d2b8a00a468",
      "new_mode": 33188,
      "new_path": "modules/adb-codegen/src/org/apache/axis2/schema/i18n/resource.properties"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "4284b7c82e774d333e12e5fc137f6fb1b15fb78d",
      "new_mode": 33188,
      "new_path": "modules/adb-codegen/test/org/apache/axis2/schema/RestrictedSchemaURIResolverTest.java"
    },
    {
      "type": "modify",
      "old_id": "7afe6b3f63f2913a9faae25c6329927f7686ee4e",
      "old_mode": 33188,
      "old_path": "modules/kernel/src/org/apache/axis2/util/XMLUtils.java",
      "new_id": "61911463ea2dffaaccdc1acfa1a73af57f1578fe",
      "new_mode": 33188,
      "new_path": "modules/kernel/src/org/apache/axis2/util/XMLUtils.java"
    },
    {
      "type": "modify",
      "old_id": "918f524627e5f2ff0199da3382d27f5628066f83",
      "old_mode": 33188,
      "old_path": "modules/tool/axis2-xsd2java-maven-plugin/src/main/java/org/apache/axis2/maven/xsd2java/AbstractXSD2JavaMojo.java",
      "new_id": "99f22698be60b13f7c82a5457572278fd5f617f2",
      "new_mode": 33188,
      "new_path": "modules/tool/axis2-xsd2java-maven-plugin/src/main/java/org/apache/axis2/maven/xsd2java/AbstractXSD2JavaMojo.java"
    },
    {
      "type": "modify",
      "old_id": "83acf4271b45802a5193a27e1c0ecef40e46afd2",
      "old_mode": 33188,
      "old_path": "src/site/markdown/release-notes/2.0.2.md",
      "new_id": "ebbc12a64c2cc943a8896f4157750005da54c8c8",
      "new_mode": 33188,
      "new_path": "src/site/markdown/release-notes/2.0.2.md"
    }
  ]
}