Google Git
Sign in
apache/commons-xml/0db292fbbfbe400a6e36fb84645a0ebb0d73d048/./pom.xml
blob: efce2a63c9dd03b74d15d59fa25693763e3d91a7 [file]
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.apache.commons</groupId>
<artifactId>commons-parent</artifactId>
<version>102</version>
</parent>
<artifactId>commons-xml</artifactId>
<version>0.1.0-SNAPSHOT</version>
<name>Apache Commons XML</name>
<url>https://commons.apache.org/sandbox/commons-xml/</url>
<inceptionYear>2026</inceptionYear>
<description>Apache Commons XML provides secure-by-default JAXP factory creation, abstracting over
implementation-specific XXE hardening differences between the stock JDK and external JAXP implementations
(Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).</description>
<scm>
<connection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</connection>
<developerConnection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</developerConnection>
<url>https://gitbox.apache.org/repos/asf?p=commons-xml.git</url>
<tag>rel/commons-xml-${project.version}</tag>
</scm>
<properties>
<!-- Release-related properties -->
<commons.release.version>0.1.0</commons.release.version>
<commons.release.desc>(Java 8+)</commons.release.desc>
<commons.rc.version>RC1</commons.rc.version>
<!-- japicmp baseline: disable for first release
<commons.bc.version>0.1.1</commons.bc.version> -->
<japicmp.skip>true</japicmp.skip>
<commons.release.next>0.1.2</commons.release.next>
<commons.componentid>xml</commons.componentid>
<commons.packageId>xml</commons.packageId>
<commons.module.name>org.apache.commons.xml</commons.module.name>
<commons.jira.id>COMMONSXML</commons.jira.id>
<!-- Sandbox component: publish the site under the sandbox tree (the parent defaults to proper/). -->
<commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/sandbox/commons-xml</commons.scmPubUrl>
<!-- OSGi bundle metadata: override commons-parent's org.apache.commons.* defaults. -->
<commons.osgi.symbolicName>org.apache.commons.xml</commons.osgi.symbolicName>
<commons.osgi.export>org.apache.commons.xml.*;version=${project.version};-noimport:=true</commons.osgi.export>
<commons.osgi.import>
net.sf.saxon.*;resolution:=optional,
org.apache.xerces.*;resolution:=optional,
*
</commons.osgi.import>
<project.build.outputTimestamp>2026-04-22T00:00:00Z</project.build.outputTimestamp>
<!-- Java baseline -->
<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>
<!-- Optional JAXP implementations used by bundled providers. -->
<commons.saxon.version>12.9</commons.saxon.version>
<commons.woodstox.version>7.1.1</commons.woodstox.version>
<commons.xalan.version>2.7.3</commons.xalan.version>
<commons.xerces.version>2.12.2</commons.xerces.version>
</properties>
<dependencies>
<!--
Saxon-HE supplies types we reference at compile time (the Saxon provider). It is not part of the consumer
contract: it is declared in provided scope, so callers who want Saxon-HE for XSLT/XPath bring it themselves
and it is never pulled in transitively.
-->
<dependency>
<groupId>net.sf.saxon</groupId>
<artifactId>Saxon-HE</artifactId>
<version>${commons.saxon.version}</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<defaultGoal>clean checkstyle:check spotbugs:check pmd:check javadoc:javadoc verify</defaultGoal>
<pluginManagement>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<configuration>
<configLocation>${basedir}/src/conf/checkstyle.xml</configLocation>
<enableRulesSummary>false</enableRulesSummary>
<!-- Later:
<includeTestSourceDirectory>true</includeTestSourceDirectory> -->
</configuration>
</plugin>
<plugin>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-maven-plugin</artifactId>
<configuration>
<excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-pmd-plugin</artifactId>
<configuration>
<rulesets>
<ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
</rulesets>
</configuration>
</plugin>
</plugins>
</pluginManagement>
<plugins>
<!--
Run the test suite seven times, each with a distinct JAXP combination:
- test-saxon: Saxon-HE (TrAX, XPath) over stock JDK SAX
- test-saxon-xerces: Saxon-HE (TrAX, XPath) over stock JDK SAX or Apache Xerces SAX
(Saxon prefers the JDK SAX provider but may resolve to Xerces)
- test-stockjdk: stock JDK factories only (every group except xpath3)
- test-woodstox: Woodstox (StAX)
- test-xalan: Apache Xalan (TrAX, XPath) over stock JDK SAX
- test-xalan-xerces: Apache Xalan (TrAX, XPath) over Apache Xerces SAX
- test-xerces: Apache Xerces (DOM, SAX, Schema)
-->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<!--
Make the underlying JAXP factories as permissive as the JDK allows. Hardened factories produced by
XmlFactories should still block every attack the test suite throws at them; if a test passes only
because the JDK's defaults intervened, we want it to fail here so the gap shows up.
Inherited by every execution defined below.
-->
<configuration>
<systemPropertyVariables>
<!-- Allow all protocols for external DTDs, schemas, and stylesheets. -->
<javax.xml.accessExternalDTD>all</javax.xml.accessExternalDTD>
<javax.xml.accessExternalSchema>all</javax.xml.accessExternalSchema>
<javax.xml.accessExternalStylesheet>all</javax.xml.accessExternalStylesheet>
</systemPropertyVariables>
</configuration>
<executions>
<execution>
<id>default-test</id>
<phase>none</phase>
</execution>
<execution>
<id>test-saxon</id>
<goals>
<goal>test</goal>
</goals>
<configuration>
<reportsDirectory>${project.build.directory}/surefire-reports/saxon</reportsDirectory>
<!-- Saxon contributes TrAX (transformer + stylesheet) and XPath; xpath3 covers Saxon-only XPath 3.1 functions. -->
<groups>trax,xpath3</groups>
</configuration>
</execution>
<execution>
<id>test-saxon-xerces</id>
<goals>
<goal>test</goal>
</goals>
<configuration>
<reportsDirectory>${project.build.directory}/surefire-reports/saxon-xerces</reportsDirectory>
<!-- Same groups as test-saxon, but with Apache Xerces also visible to Saxon's SAX-provider lookup. -->
<groups>trax,xpath3</groups>
<additionalClasspathDependencies>
<dependency>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
<version>${commons.xerces.version}</version>
</dependency>
</additionalClasspathDependencies>
</configuration>
</execution>
<execution>
<id>test-stockjdk</id>
<goals>
<goal>test</goal>
</goals>
<configuration>
<reportsDirectory>${project.build.directory}/surefire-reports/stockjdk</reportsDirectory>
<!-- Run every tagged and untagged test except xpath3, which needs Saxon on the classpath. -->
<excludedGroups>xpath3</excludedGroups>
<classpathDependencyExcludes>
<exclude>net.sf.saxon:Saxon-HE</exclude>
</classpathDependencyExcludes>
</configuration>
</execution>
<execution>
<id>test-woodstox</id>
<goals>
<goal>test</goal>
</goals>
<configuration>
<reportsDirectory>${project.build.directory}/surefire-reports/woodstox</reportsDirectory>
<!-- Woodstox only contributes StAX. -->
<groups>stax</groups>
<additionalClasspathDependencies>
<dependency>
<groupId>com.fasterxml.woodstox</groupId>
<artifactId>woodstox-core</artifactId>
<version>${commons.woodstox.version}</version>
</dependency>
</additionalClasspathDependencies>
<classpathDependencyExcludes>
<exclude>net.sf.saxon:Saxon-HE</exclude>
</classpathDependencyExcludes>
</configuration>
</execution>
<execution>
<id>test-xalan</id>
<goals>
<goal>test</goal>
</goals>
<configuration>
<reportsDirectory>${project.build.directory}/surefire-reports/xalan</reportsDirectory>
<!-- Xalan contributes TrAX and XPath. -->
<groups>xpath,trax</groups>
<additionalClasspathDependencies>
<dependency>
<groupId>xalan</groupId>
<artifactId>serializer</artifactId>
<version>${commons.xalan.version}</version>
</dependency>
<dependency>
<groupId>xalan</groupId>
<artifactId>xalan</artifactId>
<version>${commons.xalan.version}</version>
</dependency>
</additionalClasspathDependencies>
<classpathDependencyExcludes>
<exclude>net.sf.saxon:Saxon-HE</exclude>
</classpathDependencyExcludes>
</configuration>
</execution>
<execution>
<id>test-xalan-xerces</id>
<goals>
<goal>test</goal>
</goals>
<configuration>
<reportsDirectory>${project.build.directory}/surefire-reports/xalan-xerces</reportsDirectory>
<!-- Same groups as test-xalan, but with Apache Xerces winning Xalan's internal SAX-provider lookup. -->
<groups>xpath,trax</groups>
<additionalClasspathDependencies>
<dependency>
<groupId>xalan</groupId>
<artifactId>serializer</artifactId>
<version>${commons.xalan.version}</version>
</dependency>
<dependency>
<groupId>xalan</groupId>
<artifactId>xalan</artifactId>
<version>${commons.xalan.version}</version>
</dependency>
<dependency>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
<version>${commons.xerces.version}</version>
</dependency>
</additionalClasspathDependencies>
<classpathDependencyExcludes>
<exclude>net.sf.saxon:Saxon-HE</exclude>
</classpathDependencyExcludes>
</configuration>
</execution>
<execution>
<id>test-xerces</id>
<goals>
<goal>test</goal>
</goals>
<configuration>
<reportsDirectory>${project.build.directory}/surefire-reports/xerces</reportsDirectory>
<!-- Xerces only contributes DOM/SAX/Schema; the rest is JDK-bundled and already covered by test-stockjdk. -->
<groups>dom,sax,schema</groups>
<additionalClasspathDependencies>
<dependency>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
<version>${commons.xerces.version}</version>
</dependency>
</additionalClasspathDependencies>
<classpathDependencyExcludes>
<exclude>net.sf.saxon:Saxon-HE</exclude>
</classpathDependencyExcludes>
</configuration>
</execution>
</executions>
</plugin>
<!-- Do not publish a test-jar: the test classes are not part of the consumer contract. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<executions>
<execution>
<id>default</id>
<phase>none</phase>
</execution>
</executions>
</plugin>
<!--
commons-parent's create-source-jar execution attaches both the main sources (jar-no-fork) and the test
sources (test-jar-no-fork) in one execution. Disable it and re-bind a main-sources-only execution, so the
published artifact keeps the required sources jar but drops the test-sources jar.
-->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<executions>
<execution>
<id>create-source-jar</id>
<phase>none</phase>
</execution>
<execution>
<id>create-main-source-jar</id>
<phase>package</phase>
<goals>
<goal>jar-no-fork</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- jdeps makes Saxon.HE a hard requires; flip it to static (optional). The trailing * keeps the rest. -->
<plugin>
<groupId>org.moditect</groupId>
<artifactId>moditect-maven-plugin</artifactId>
<executions>
<execution>
<id>add-module-infos</id>
<configuration>
<module>
<moduleInfo>
<requires>
static Saxon.HE;
*;
</requires>
</moduleInfo>
</module>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
</plugin>
</plugins>
</build>
<reporting>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
</plugin>
<plugin>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-maven-plugin</artifactId>
<configuration>
<excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-pmd-plugin</artifactId>
<configuration>
<rulesets>
<ruleset>src/conf/maven-pmd-plugin.xml</ruleset>
</rulesets>
</configuration>
</plugin>
</plugins>
</reporting>
<profiles>
<!--
Regression guard for the generated OSGi and JPMS descriptors.
The JPMS test requires JDK 9+
-->
<profile>
<id>java11-tests</id>
<activation>
<jdk>[11,)</jdk>
</activation>
<build>
<plugins>
<!-- Compile the src/test/java11 source root at release 11; the default test sources stay at release 8. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<executions>
<execution>
<id>testCompile-java11</id>
<phase>test-compile</phase>
<goals>
<goal>testCompile</goal>
</goals>
<configuration>
<release>11</release>
<compileSourceRoots>
<compileSourceRoot>${project.basedir}/src/test/java11</compileSourceRoot>
</compileSourceRoots>
</configuration>
</execution>
</executions>
</plugin>
<!-- Run DescriptorIT against the packaged jar; no OSGi framework or separate JPMS module needed. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-failsafe-plugin</artifactId>
<executions>
<execution>
<id>verify-descriptors</id>
<goals>
<goal>integration-test</goal>
<goal>verify</goal>
</goals>
<configuration>
<systemPropertyVariables>
<buildJar>${project.build.directory}/${project.build.finalName}.jar</buildJar>
</systemPropertyVariables>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
</profiles>
<developers>
<developer>
<id>ppkarwasz</id>
<name>Piotr P. Karwasz</name>
<email>pkarwasz-pom@apache.org</email>
</developer>
<developer>
<id>ggregory</id>
<name>Gary Gregory</name>
<email>ggregory at apache.org</email>
<url>https://www.garygregory.com</url>
<organization>The Apache Software Foundation</organization>
<organizationUrl>https://www.apache.org/</organizationUrl>
<roles>
<role>PMC Member</role>
</roles>
<timezone>America/New_York</timezone>
<properties>
<picUrl>https://people.apache.org/~ggregory/img/garydgregory80.png</picUrl>
</properties>
</developer>
</developers>
</project>