Current V2.7.2 edits merged from maintenance branch back to trunk
diff --git a/.classpath b/.classpath
index b4df3de..a390f75 100644
--- a/.classpath
+++ b/.classpath
@@ -1,29 +1,13 @@
<?xml version="1.0" encoding="UTF-8"?>
-<!--
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
--->
<classpath>
<classpathentry kind="src" path="src"/>
- <classpathentry kind="lib" path="lib/xml-apis.jar"/>
- <classpathentry kind="lib" path="lib/xercesImpl.jar"/>
+ <classpathentry kind="lib" path="C:/vcs/svn/apache/xalan-j/branches/xalan-j_2_7_1_maint/java/lib/endorsed/xml-apis.jar"/>
+ <classpathentry kind="lib" path="C:/vcs/svn/apache/xalan-j/branches/xalan-j_2_7_1_maint/java/lib/endorsed/xercesImpl.jar"/>
<classpathentry kind="lib" path="lib/BCEL.jar"/>
<classpathentry kind="lib" path="lib/runtime.jar"/>
<classpathentry kind="lib" path="lib/regexp.jar"/>
<classpathentry kind="lib" path="tools/java_cup.jar"/>
<classpathentry kind="lib" path="tools/JLex.jar"/>
<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/J2SE-1.3"/>
- <classpathentry kind="output" path="bin"/>
+ <classpathentry kind="output" path="build/classes"/>
</classpath>
diff --git a/.project b/.project
index a9c27c9..47ae031 100644
--- a/.project
+++ b/.project
@@ -16,7 +16,7 @@
* limitations under the License.
-->
<projectDescription>
- <name>xalan-java-trunk</name>
+ <name>apache-xalan-j-2.7.1-maint-main</name>
<comment></comment>
<projects>
</projects>
diff --git a/KEYS b/KEYS
index 3469523..e31cf63 100644
--- a/KEYS
+++ b/KEYS
@@ -411,3 +411,36 @@
=NDBw
-----END PGP PUBLIC KEY BLOCK-----
+Gary David Gregory (Code signing key) <ggregory@apache.org>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.11 (MingW32)
+
+mQENBE2kzuwBCACYV+G9yxNkSjAKSji0B5ipMGM74JAL1Ogtcu+993pLHHYsdXri
+WWXi37x9PLjeHxw63mN26SFyrbMJ4A8erLB03PDjw0DEzAwiu9P2vSvL/RFxGBbk
+cM0BTNXNR1rk8DpIzvXtejp8IHtD1qcDLTlJ8D0W3USebShDPo6NmMxTNuH0u99B
+WHCMAdSa34wsg0ZpffwQmRxeA+ebrf2ydKupGkeZsKjkLlaXNkTVp1ghn5ts/lvg
+KeHv1SJivWKCRmFlbPhBK4+mxSUSOPdoBNAfxA51QzZoPizSk0VbRz3YufYRVLFy
+9vqPSorDmYJhCvn3f6+A38FS/j8VE+8obQ2rABEBAAG0O0dhcnkgRGF2aWQgR3Jl
+Z29yeSAoQ29kZSBzaWduaW5nIGtleSkgPGdncmVnb3J5QGFwYWNoZS5vcmc+iQE4
+BBMBAgAiBQJNpM7sAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCG/cfi
+oRJiy2vXCACU6jW2+XIWuWBKSmeowBMxlUMJFSq7QjLt+o6B1ZYClbzBLDKcxlnS
+dF6v0jLhp71LozTde+HFI4/qIv6OO4UaGHin8Z1rNU/i5L07HkhLxcrbDoWhaSGD
+buRsWCv9ljm5GCXyK9s6Uj7d4af9mDWaGhNFJJFIs+yqOvTwffoaB7y+2a1YWStZ
+ZXDJ0KiHdY7xQ7bbYR/61MgvJslF1uX+u4jLTNmbU0tCXLtUrLd2VbJiAMFezqy6
+hV/ZxQLZoBPpr3FYhR2SIzNhQ30nj9AVcPgCCuLD49nx6Ad5CpcP8sTwb4aWk9GK
++Uu3Bfz4jTAvd9Q7TsRMt3NV+7sOGD4vuQENBE2kzuwBCACzeGpkd6X/xTfKDBWv
+XgHOOKIJ2pht9XmtZZKiIj7LIiSwvSds/ZkoZKxAm7AY+KPh8Xjf968FtoUBQJvH
+AG4rbowEqT7OOrJae2JcenH5qzaod7TpIPQVv+Ysz8I1wLlC6LzKRj1X99Hng6X+
+obsEasnPbmEEkuiZ/Sgi4vVC8SHkDmYt1Dx8jDgm53oUeWkEJO9LSI2zcrZhSgvg
+1xa4Q4gY5UUK7gE4LbmGCjFlATuuW/0sryxu8zxph15gkn4Nqgk0CPMSjesMYEGO
+sdDzfQXl2tXbt+Pe6mBoWh67MZ1v5zOq3EDtoSqDpWPxponAeaCuNDDFX44vGjfx
+GE0tABEBAAGJAR8EGAECAAkFAk2kzuwCGwwACgkQhv3H4qESYsvEMAf/VGyqIEcw
+4T2D3gZZ3ITkeoBevQdxBT/27xNvoWOZyGSzGYlRbRQrlo+uZsjfMc9MNvaSmxyy
+4gLVbcdvQr3PF//GxphJ98W8pk9l+M57jfyHnnCumn7MO4o9ed+WuigN5oeuNJ6B
+Iq3ff2o1DsrEvDChYOJEOeFuWxv+u7I2ABJJep7NbByM2n9PE8vlGU3zUBgWUBsk
+6jT+klKnEyHE76WzegPLz3jtElTuyB7jRhjyQJu1yiJEMbs2zH8aJGObi5f8Jum4
+tILZuEAdoI0M3c3VRq12cz/vLy+9VXa/s//8IsGn88kjyyYqOy8WJEjoOXFh++dp
+WiM7nZkgQcNi5A==
+=0UFs
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/NOTICE.txt b/NOTICE.txt
index b3fef42..132f8bc 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -4,7 +4,7 @@
=========================================================================
Apache Xalan (Xalan XSLT processor)
- Copyright 1999-2012 The Apache Software Foundation
+ Copyright 1999-2014 The Apache Software Foundation
Apache Xalan (Xalan serializer)
Copyright 1999-2012 The Apache Software Foundation
diff --git a/build.bat b/build.bat
index 1281e46..36de687 100755
--- a/build.bat
+++ b/build.bat
@@ -23,7 +23,7 @@
rem - you should set JAVA_HOME
rem - you can set ANT_HOME if you use your own Ant install
rem - JAVA_OPTS is added to the java command line
-rem - PARSER_JAR may be set to use alternate parser (default:lib\xercesImpl.jar)
+rem - PARSER_JAR may be set to use alternate parser (default:lib\endorsed\xercesImpl.jar)
echo.
echo Xalan-J 2.x Build
echo -------------
@@ -52,9 +52,9 @@
set _ANT_JAR=%ANT_JAR%
if "%_ANT_JAR%" == "" set _ANT_JAR=tools\ant.jar
set _PARSER_JAR=%PARSER_JAR%
-if "%_PARSER_JAR%" == "" set _PARSER_JAR=lib\xercesImpl.jar
+if "%_PARSER_JAR%" == "" set _PARSER_JAR=lib\endorsed\xercesImpl.jar
set _XML-APIS_JAR=%XML-APIS_JAR%
-if "%_XML-APIS_JAR%" == "" set _XML-APIS_JAR=lib\xml-apis.jar
+if "%_XML-APIS_JAR%" == "" set _XML-APIS_JAR=lib\endorsed\xml-apis.jar
rem Attempt to automatically add system classes to _CLASSPATH
rem Use _underscore prefix to not conflict with user's settings
diff --git a/build.sh b/build.sh
index 4e75ee1..e21d6e1 100755
--- a/build.sh
+++ b/build.sh
@@ -39,11 +39,11 @@
ANT_JAR=./tools/ant.jar
fi
if [ "$PARSER_JAR" = "" ] ; then
- PARSER_JAR=./lib/xercesImpl.jar
+ PARSER_JAR=./lib/endorsed/xercesImpl.jar
fi
if [ "$XML_APIS_JAR" = "" ] ; then
- XML_APIS_JAR=./lib/xml-apis.jar
+ XML_APIS_JAR=./lib/endorsed/xml-apis.jar
fi
# Use _underscore prefix to not conflict with user's settings
diff --git a/build.xml b/build.xml
index 00015fa..395bae1 100644
--- a/build.xml
+++ b/build.xml
@@ -62,13 +62,15 @@
<project name="Xalan" default="jar" basedir=".">
<property name="name" value="xalan"/>
- <property name="year" value="2012"/>
+ <property name="year" value="2014"/>
<property name="build.debug" value="on"/>
+ <property name="compiler.target" value="1.3"/>
+ <property name="compiler.source" value="1.3"/>
<!-- Xalan Java version information -->
<property name="version.VERSION" value="2"/>
<property name="version.RELEASE" value="7"/>
- <property name="version.DEVELOPER" value="D"/><!-- Set this to 'D' if a developer release; blank "" if maintenance release -->
+ <property name="version.DEVELOPER" value=""/><!-- Set this to 'D' if a developer release; blank "" if maintenance release -->
<property name="version.MINOR" value="2"/><!-- EITHER the developer release number, or a maintenance release number -->
<property name="version" value="${version.VERSION}_${version.RELEASE}_${version.DEVELOPER}${version.MINOR}"/><!-- GUMP: version # of dist file -->
<property name="impl.version" value="${version.VERSION}.${version.RELEASE}.${version.DEVELOPER}${version.MINOR}"/><!-- Used in jar task for filtering MANIFEST.MF file -->
@@ -79,9 +81,10 @@
<property name="parser.version.MINOR" value="0"/>
<!-- Xalan Java directories -->
-<!-- <property name="bin.dir" value="./bin"/> -->
+ <!-- <property name="bin.dir" value="./bin"/> -->
<property name="build.dir" value="./build"/>
<property name="lib.dir" value="./lib"/>
+ <property name="endorsed.dir" value="${lib.dir}/endorsed"/>
<property name="samples.dir" value="./samples"/>
<property name="src.dir" value="./src"/>
<property name="tools.dir" value="./tools"/>
@@ -94,11 +97,11 @@
<property name="domxpath.reldir" value="org/w3c/dom/xpath"/>
<property name="xsltc.reldir" value="${xalan.reldir}/xsltc"/>
- <!-- Jars needed to run Xalan Java (Interpretive, Compiled, or both) -->
+ <!-- Jars to run Xalan Java (Interpretive, Compiled, or both) -->
<property name="xmlapis.jar.name" value="xml-apis.jar"/>
- <property name="xmlapis.jar" value="${lib.dir}/${xmlapis.jar.name}"/>
+ <property name="xmlapis.jar" value="${endorsed.dir}/${xmlapis.jar.name}"/>
<property name="parser.jar.name" value="xercesImpl.jar"/>
- <property name="parser.jar" value="${lib.dir}/${parser.jar.name}"/>
+ <property name="parser.jar" value="${endorsed.dir}/${parser.jar.name}"/>
<property name="bcel.jar.name" value="BCEL.jar"/>
<property name="bcel.jar" value="${lib.dir}/${bcel.jar.name}"/>
<property name="runtime.jar.name" value="runtime.jar"/>
@@ -106,7 +109,7 @@
<property name="regexp.jar.name" value="regexp.jar"/>
<property name="regexp.jar" value="${lib.dir}/${regexp.jar.name}"/>
- <!-- Jars need to build Xalan Java (Interpretive, Compiled, or both) or build the docs -->
+ <!-- Jars to build Xalan Java (Interpretive, Compiled, or both) or build the docs -->
<property name="java_cup.jar.name" value="java_cup.jar"/>
<property name="java_cup.jar" value="${tools.dir}/${java_cup.jar.name}"/>
<property name="jlex.jar.name" value="JLex.jar"/>
@@ -118,6 +121,13 @@
<property name="taglet.jar.name" value="xalan2jtaglet.jar"/>
<property name="taglet.jar" value="${tools.dir}/${taglet.jar.name}"/>
+ <!-- Jars to build Xalan Java samples -->
+ <property name="servlet-api.jar.name" value="servlet-api-2.5.jar"/>
+ <property name="servlet-api.jar" value="${lib.dir}/${servlet-api.jar.name}"/>
+ <property name="javaee-api.jar.name" value="javaee-api-5.0-2.jar"/>
+ <property name="javaee-api.jar" value="${lib.dir}/${javaee-api.jar.name}"/>
+ <property name="brazil.jar.name" value="brazil-2.1.jar"/>
+ <property name="brazil.jar" value="${lib.dir}/${brazil.jar.name}"/>
<!-- Relative locations of source directories -->
<property name="manifest.mf" value="./src/MANIFEST.MF"/>
@@ -373,7 +383,8 @@
<echo message="Compiling DTM implementation and utilities" />
<javac srcdir="${src.dir}"
destdir="${build.classes}"
- debug="${build.debug}" >
+ debug="${build.debug}"
+ target="${compiler.target}" source="${compiler.source}">
<include name="${apachexml.reldir}/**/*.java" />
<!-- exclude the serializer -->
<exclude name="${serializer.reldir}/**/*.java" />
@@ -400,7 +411,8 @@
<echo message="Compiling Xalan interpretive classes" />
<javac srcdir="${src.dir}"
destdir="${build.classes}"
- debug="${build.debug}" >
+ debug="${build.debug}"
+ target="${compiler.target}" source="${compiler.source}">
<include name="${xpath.reldir}/**/*.java" />
<include name="${domxpath.reldir}/**/*.java" />
<include name="${xalan.reldir}/**/*.java" />
@@ -446,7 +458,8 @@
<javac srcdir="${src.dir}"
destdir="${build.classes}"
includes="${xsltc.reldir}/util/**/*.java"
- debug="${build.debug}">
+ debug="${build.debug}"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="xsltc.class.path" />
<bootclasspath refid="xslt.boot.class.path" />
</javac>
@@ -509,7 +522,8 @@
destdir="${build.classes}"
includes="${xsltc.reldir}/**/*.java"
excludes="${serializer.reldir}/**/*.java"
- debug="${build.debug}">
+ debug="${build.debug}"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="xsltc.class.path" />
<bootclasspath refid="xslt.boot.class.path" />
</javac>
@@ -522,7 +536,8 @@
<javac srcdir="${src.dir}"
destdir="${build.classes}"
includes="${xsltc.reldir}/**/*.java"
- debug="${build.debug}">
+ debug="${build.debug}"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="xsltc.class.path" />
<bootclasspath refid="xslt.boot.class.path" />
</javac>
@@ -723,27 +738,32 @@
<!-- Since the samples are packageless, they must be compiled separately. -->
<javac srcdir="${samples.dir}/SimpleTransform"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/UseStylesheetPI"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/UseStylesheetParam"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/SAX2SAX"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/DOM2DOM"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/Pipe"
@@ -753,47 +773,56 @@
</javac>
<javac srcdir="${samples.dir}/UseXMLFilters"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/Trace"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/ApplyXPath"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/ApplyXPathDOM"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/trax"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/extensions"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/Validate"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/TransformThread"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<javac srcdir="${samples.dir}/XPathAPI"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" >
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
<classpath refid="samples.class.path" />
</javac>
<jar jarfile="${build.samples.jar}" basedir="${build.samples}"
@@ -808,8 +837,8 @@
depends="servlet,xsltc.applet,xsltc.ejb,xsltc.servlet"/>
<target name="extra.std.samples.nojardepends"
- depends="servlet.nojardepends,xsltc.applet.nojardepends,
- xsltc.ejb.nojardepends,xsltc.servlet.nojardepends"/>
+ depends="servlet.jardepends,xsltc.applet.nojardepends,
+ xsltc.ejb.jardepends,xsltc.servlet.jardepends"/>
<!-- =================================================================== -->
<!-- Compiles all samples that require extra non-standard components in -->
@@ -817,16 +846,16 @@
<!-- =================================================================== -->
<target name="extra.nonstd.samples" depends="xsltc.brazil"/>
- <target name="extra.nonstd.samples.nojardepends" depends="xsltc.brazil.nojardepends"/>
+ <target name="extra.nonstd.samples.nojardepends" depends="xsltc.brazil.jardepends"/>
<!-- =================================================================== -->
<!-- Compiles the sample servlet and jars the class files. -->
<!-- The javax.servlet and javax.servlet.http packages -->
<!-- must be on the classpath -->
<!-- =================================================================== -->
- <target name="servlet" depends="jar,servlet.nojardepends"/>
+ <target name="servlet" depends="jar,servlet.jardepends"/>
- <target name="servlet.nojardepends"
+ <target name="servlet.jardepends"
description="Compile and jar the servlet samples in xalanservlet.war" >
<echo message="To compile the sample servlets, javax.servlet and javax.servlet.http must be on the classpath"/>
<mkdir dir="${build.servlet}"/>
@@ -835,8 +864,10 @@
<javac srcdir="${samples.dir}/servlet"
destdir="${build.servlet}/WEB-INF/classes"
debug="${build.debug}"
- bootclasspathref="xslt.boot.class.path" >
- <classpath refid="samples.class.path" />
+ bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
+ <classpath refid="samples.class.path" />
+ <classpath location="${servlet-api.jar}" />
</javac>
<copy todir="${build.servlet}/WEB-INF/classes/servlet">
<fileset dir="${samples.dir}/servlet" includes="media.properties"/>
@@ -875,10 +906,12 @@
<javac srcdir="${samples.dir}/translets"
classpath="${java.class.path}:${build.xalan.jar}"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" />
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}"/>
<javac srcdir="${samples.dir}/CompiledJAXP"
destdir="${build.samples}" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" />
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}"/>
</target>
<!-- =================================================================== -->
@@ -890,7 +923,8 @@
<mkdir dir="${build.samples}/CompiledApplet"/>
<javac srcdir="${samples.dir}/CompiledApplet"
destdir="${build.samples}/CompiledApplet" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" />
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}"/>
<jar jarfile="${build.xsltc.applet.jar}"
basedir="${build.samples}/CompiledApplet"
includes="*.class"/>
@@ -899,13 +933,16 @@
<!-- =================================================================== -->
<!-- Compiles the XSLTC brazil example and jars the class files. -->
<!-- =================================================================== -->
- <target name="xsltc.brazil" depends="jar,xsltc.brazil.nojardepends"/>
+ <target name="xsltc.brazil" depends="jar,xsltc.brazil.jardepends"/>
- <target name="xsltc.brazil.nojardepends">
+ <target name="xsltc.brazil.jardepends">
<mkdir dir="${build.samples}/CompiledBrazil"/>
<javac srcdir="${samples.dir}/CompiledBrazil"
destdir="${build.samples}/CompiledBrazil" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" />
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
+ <classpath location="${brazil.jar}"/>
+ </javac>
<jar jarfile="${build.xsltc.brazil.jar}"
basedir="${build.samples}/CompiledBrazil"
includes="*.class"/>
@@ -916,13 +953,16 @@
<!-- ejb.jar must be on the classpath to compile this sample. -->
<!-- EJB 2.0 can be found at http://java.sun.com/products/ejb/docs.html -->
<!-- =================================================================== -->
- <target name="xsltc.ejb" depends="jar,xsltc.ejb.nojardepends"/>
+ <target name="xsltc.ejb" depends="jar,xsltc.ejb.jardepends"/>
- <target name="xsltc.ejb.nojardepends">
+ <target name="xsltc.ejb.jardepends">
<mkdir dir="${build.samples}/CompiledEJB"/>
<javac srcdir="${samples.dir}/CompiledEJB"
destdir="${build.samples}/CompiledEJB" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" />
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
+ <classpath location="${javaee-api.jar}"/>
+ </javac>
<jar jarfile="${build.xsltc.ejb.jar}"
basedir="${build.samples}/CompiledEJB"
includes="*.class"/>
@@ -931,13 +971,16 @@
<!-- =================================================================== -->
<!-- Compiles the XSLTC servlet example and jars the class files. -->
<!-- =================================================================== -->
- <target name="xsltc.servlet" depends="jar,xsltc.servlet.nojardepends" />
+ <target name="xsltc.servlet" depends="jar,xsltc.servlet.jardepends" />
- <target name="xsltc.servlet.nojardepends">
+ <target name="xsltc.servlet.jardepends">
<mkdir dir="${build.samples}/CompiledServlet"/>
<javac srcdir="${samples.dir}/CompiledServlet"
destdir="${build.samples}/CompiledServlet" excludes="${exclude}"
- debug="${build.debug}" bootclasspathref="xslt.boot.class.path" />
+ debug="${build.debug}" bootclasspathref="xslt.boot.class.path"
+ target="${compiler.target}" source="${compiler.source}">
+ <classpath location="${servlet-api.jar}"/>
+ </javac>
<jar jarfile="${build.xsltc.servlet.jar}"
basedir="${build.samples}/CompiledServlet"
includes="*.class"/>
@@ -1113,13 +1156,14 @@
<delete file="${xdocs.XSLTCDONE.location}"/>
<delete file="${src.dir}/${xalan.reldir}/Version.java"/>
<delete file="${src.dir}/${serializer.reldir}/Version.java"/>
+ <delete file="${src.dir}/${xalan.reldir}/processor/XSLProcessorVersion.java"/>
<delete file="${xdocs.dir}/sources/entities.ent"/>
<!-- Also delete files expanded from ${xml-commons-srcs.tar.gz}-->
<delete dir="${src.dir}/javax" includeEmptyDirs="true" quiet="true"/>
<delete dir="${src.dir}/org/xml" includeEmptyDirs="true" quiet="true"/>
<delete dir="${src.dir}/org/w3c" includeEmptyDirs="true" quiet="true"/>
<delete dir="${src.dir}/xdocs/style/graphics" includeEmptyDirs="true" quiet="true"/>
- <delete dir="${src.dir}/xdocs/style/resources" includeEmptyDirs="true" quiet="true"/>
+ <delete dir="${src.dir}/xdocs/style/resources" includeEmptyDirs="true" quiet="true"/>
</target>
<target name="xsltc.clean"
@@ -1642,7 +1686,8 @@
<echo message="Compiling the Serializer" />
<javac srcdir="${serializer.src.dir}"
destdir="${serializer.build.classes}"
- debug="${serializer.build.debug}" >
+ debug="${serializer.build.debug}"
+ target="${compiler.target}" source="${compiler.source}">
<include name="${serializer.reldir}/**/*.java" />
<classpath refid="compile.class.path" />
<bootclasspath refid="xslt.boot.class.path" />
diff --git a/lib/brazil-2.1.jar b/lib/brazil-2.1.jar
new file mode 100644
index 0000000..78a1e78
--- /dev/null
+++ b/lib/brazil-2.1.jar
Binary files differ
diff --git a/lib/endorsed/xercesImpl.jar b/lib/endorsed/xercesImpl.jar
new file mode 100644
index 0000000..0aaa990
--- /dev/null
+++ b/lib/endorsed/xercesImpl.jar
Binary files differ
diff --git a/lib/endorsed/xml-apis.jar b/lib/endorsed/xml-apis.jar
new file mode 100644
index 0000000..4673346
--- /dev/null
+++ b/lib/endorsed/xml-apis.jar
Binary files differ
diff --git a/lib/javaee-api-5.0-2.jar b/lib/javaee-api-5.0-2.jar
new file mode 100644
index 0000000..65acd77
--- /dev/null
+++ b/lib/javaee-api-5.0-2.jar
Binary files differ
diff --git a/lib/servlet-api-2.5.jar b/lib/servlet-api-2.5.jar
new file mode 100644
index 0000000..b0537c4
--- /dev/null
+++ b/lib/servlet-api-2.5.jar
Binary files differ
diff --git a/src/org/apache/xalan/Version.java b/src/org/apache/xalan/Version.java
index c2d9f2f..570d2bd 100644
--- a/src/org/apache/xalan/Version.java
+++ b/src/org/apache/xalan/Version.java
@@ -119,7 +119,7 @@
*/
public static int getMaintenanceVersionNum()
{
- return 1;
+ return 2;
}
/**
diff --git a/src/org/apache/xalan/processor/TransformerFactoryImpl.java b/src/org/apache/xalan/processor/TransformerFactoryImpl.java
index 87e2344..3a7c78c 100644
--- a/src/org/apache/xalan/processor/TransformerFactoryImpl.java
+++ b/src/org/apache/xalan/processor/TransformerFactoryImpl.java
@@ -326,6 +326,10 @@
reader = XMLReaderFactory.createXMLReader();
}
+ if(m_isSecureProcessing)
+ {
+ reader.setFeature("http://xml.org/sax/features/external-general-entities",false);
+ }
// Need to set options!
reader.setContentHandler(handler);
reader.parse(isource);
diff --git a/src/org/apache/xalan/processor/XSLTElementProcessor.java b/src/org/apache/xalan/processor/XSLTElementProcessor.java
index 4225f59..553832d 100644
--- a/src/org/apache/xalan/processor/XSLTElementProcessor.java
+++ b/src/org/apache/xalan/processor/XSLTElementProcessor.java
@@ -337,17 +337,31 @@
}
else
{
- // Can we switch the order here:
-
- boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName,
- attributes.getQName(i), attributes.getValue(i),
- target);
-
- // Now we only add the element if it passed a validation check
- if (success)
- processedDefs.add(attrDef);
+ //handle secure processing
+ if(handler.getStylesheetProcessor()==null)
+ System.out.println("stylesheet processor null");
+ if(attrDef.getName().compareTo("*")==0 && handler.getStylesheetProcessor().isSecureProcessing())
+ {
+ //foreign attributes are not allowed in secure processing mode
+ // Then barf, because this element does not allow this attribute.
+ handler.error(XSLTErrorResources.ER_ATTR_NOT_ALLOWED, new Object[]{attributes.getQName(i), rawName}, null);//"\""+attributes.getQName(i)+"\""
+ //+ " attribute is not allowed on the " + rawName
+ // + " element!", null);
+ }
else
- errorDefs.add(attrDef);
+ {
+
+
+ boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName,
+ attributes.getQName(i), attributes.getValue(i),
+ target);
+
+ // Now we only add the element if it passed a validation check
+ if (success)
+ processedDefs.add(attrDef);
+ else
+ errorDefs.add(attrDef);
+ }
}
}
diff --git a/src/org/apache/xalan/transformer/TransformerImpl.java b/src/org/apache/xalan/transformer/TransformerImpl.java
index f999f6d..bd9baaf 100644
--- a/src/org/apache/xalan/transformer/TransformerImpl.java
+++ b/src/org/apache/xalan/transformer/TransformerImpl.java
@@ -438,7 +438,9 @@
try
{
if (sroot.getExtensions() != null)
- m_extensionsTable = new ExtensionsTable(sroot);
+ //only load extensions if secureProcessing is disabled
+ if(!sroot.isSecureProcessing())
+ m_extensionsTable = new ExtensionsTable(sroot);
}
catch (javax.xml.transform.TransformerException te)
{te.printStackTrace();}
diff --git a/src/org/apache/xml/serializer/Version.java b/src/org/apache/xml/serializer/Version.java
index cea72a6..f973e2b 100644
--- a/src/org/apache/xml/serializer/Version.java
+++ b/src/org/apache/xml/serializer/Version.java
@@ -116,7 +116,7 @@
*/
public static int getMaintenanceVersionNum()
{
- return 1;
+ return 2;
}
/**
diff --git a/src/org/apache/xpath/functions/FuncSystemProperty.java b/src/org/apache/xpath/functions/FuncSystemProperty.java
index 4d94a76..1787f3b 100644
--- a/src/org/apache/xpath/functions/FuncSystemProperty.java
+++ b/src/org/apache/xpath/functions/FuncSystemProperty.java
@@ -57,7 +57,7 @@
String fullName = m_arg0.execute(xctxt).str();
int indexOfNSSep = fullName.indexOf(':');
- String result;
+ String result = null;
String propName = "";
// List of properties where the name of the
@@ -97,14 +97,20 @@
try
{
- result = System.getProperty(propName);
-
- if (null == result)
- {
-
- // result = System.getenv(propName);
- return XString.EMPTYSTRING;
- }
+ //if secure procession is enabled only handle required properties do not not map any valid system property
+ if(!xctxt.isSecureProcessing())
+ {
+ result = System.getProperty(propName);
+ }
+ else
+ {
+ warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION,
+ new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName);
+ }
+ if (null == result)
+ {
+ return XString.EMPTYSTRING;
+ }
}
catch (SecurityException se)
{
@@ -119,14 +125,20 @@
{
try
{
- result = System.getProperty(fullName);
-
- if (null == result)
- {
-
- // result = System.getenv(fullName);
- return XString.EMPTYSTRING;
- }
+ //if secure procession is enabled only handle required properties do not not map any valid system property
+ if(!xctxt.isSecureProcessing())
+ {
+ result = System.getProperty(fullName);
+ }
+ else
+ {
+ warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION,
+ new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName);
+ }
+ if (null == result)
+ {
+ return XString.EMPTYSTRING;
+ }
}
catch (SecurityException se)
{
diff --git a/xdocs/sources/entities.src b/xdocs/sources/entities.src
index 422287d..b58c392 100644
--- a/xdocs/sources/entities.src
+++ b/xdocs/sources/entities.src
@@ -26,7 +26,7 @@
<!ENTITY xslt4j-dist-src "&xslt4j-dist;-src">
<!ENTITY xslt4j-dist "xalan-j_@version.VERSION@_@version.RELEASE@_@version.MINOR@">
<!ENTITY xslt4j-current "&xslt4j; Version @version.VERSION@.@version.RELEASE@.@version.MINOR@">
-<!ENTITY xslt4j-distdir "http://www.apache.org/dyn/closer.cgi/xalan/xalan-j/">
+<!ENTITY xslt4j-distdir "http://www.apache.org/dyn/closer.cgi/xml/xalan-j/">
<!ENTITY xslt4j_longname "Apache Xalan Java">
<!ENTITY xml4j "Xerces-Java">
<!ENTITY xml4j1 "Xerces-Java 1">
diff --git a/xdocs/sources/xalan-apache-org-site.xml b/xdocs/sources/xalan-apache-org-site.xml
index ee59067..300ff1e 100644
--- a/xdocs/sources/xalan-apache-org-site.xml
+++ b/xdocs/sources/xalan-apache-org-site.xml
@@ -19,7 +19,7 @@
-->
<!-- $Id$ -->
-<book title="Apache Xalan Project " copyright="1999-2012 The Apache Software Foundation">
+<book title="Apache Xalan Project " copyright="1999-2014 The Apache Software Foundation">
<document id="index" label="Apache Xalan" source="xalan-apache-org/index.xml"/>
<document id="charter" label="Charter" source="xalan/charter.xml"/>
<separator/>
diff --git a/xdocs/sources/xalan-jlocal.xml b/xdocs/sources/xalan-jlocal.xml
index 0b28432..36236ec 100644
--- a/xdocs/sources/xalan-jlocal.xml
+++ b/xdocs/sources/xalan-jlocal.xml
@@ -19,7 +19,7 @@
-->
<!-- $Id$ -->
-<book title="Xalan XSL Transformer User's Guide" copyright="1999-2012 The Apache Software Foundation">
+<book title="Xalan XSL Transformer User's Guide" copyright="1999-2014 The Apache Software Foundation">
<resources source="sbk:/sources/xalan/resources.xml"/>
<document id="whatsnew" label="What's New" source="xalan/whatsnew.xml"/>
<document id="readme" label="Release Notes" source="xalan/readme.xml"/>
diff --git a/xdocs/sources/xalan-jsite.xml b/xdocs/sources/xalan-jsite.xml
index cab7983..ce2bde0 100644
--- a/xdocs/sources/xalan-jsite.xml
+++ b/xdocs/sources/xalan-jsite.xml
@@ -19,11 +19,11 @@
-->
<!-- $Id$ -->
-<book title="Xalan XSL Transformer User's Guide" copyright="1999-2012 The Apache Software Foundation">
+<book title="Xalan XSL Transformer User's Guide" copyright="1999-2014 The Apache Software Foundation">
<resources source="sbk:/sources/xalan/resources.xml"/>
<external href="http://xalan.apache.org/index.html" label="Home"/>
<separator/>
- <document id="index" label="Xalan-J 2.7.1" source="xalan/index.xml"/>
+ <document id="index" label="Xalan-J 2.7.2" source="xalan/index.xml"/>
<document id="charter" label="Charter" source="xalan/charter.xml"/>
<separator/>
<document id="whatsnew" label="What's New" source="xalan/whatsnew.xml"/>
diff --git a/xdocs/sources/xalan/builds.xml b/xdocs/sources/xalan/builds.xml
index 915c683..7617037 100644
--- a/xdocs/sources/xalan/builds.xml
+++ b/xdocs/sources/xalan/builds.xml
@@ -110,7 +110,7 @@
branch if the mainline development has already moved forward; the point is to
make critical bugfixes for existing customers who want to stay on the stable release.<br/><br/></li>
<li>Developer releases are very ad hoc; they represent a chunk of progress along the
-HEAD of our CVS tree towards a new major or minor release. The developer release
+HEAD of our Subversion tree towards a new major or minor release. The developer release
versions would be going from 2.3 to a new 2.4.D1 - the developer release is somewhat
like a 'beta' towards a new 2.4 minor version release. Quality standards for developer
releases are much less stringent than other releases.<br/><br/></li>
@@ -210,15 +210,15 @@
<ul>
<li>Do a clean checkout and tag the sources.</li>
</ul>
-<p>Of course, you checked in all your earlier work to the CVS repository, right?</p>
+<p>Of course, you checked in all your earlier work to the Subversion repository, right?</p>
<p>The safest way to perform a build for distribution is to check out a fresh
-new copy of the repository from CVS. This avoids any potential problems with
+new copy of the repository from Subversion. This avoids any potential problems with
uncommitted changes or extra files on your local machine.</p>
<p>Check out a new copy of both xml-xalan/java and xml-xalan/test repositories
to a blank directory on your local machine. You then need to tag the files in
the repository with a marker noting that these versions are the actual ones
being used in the build (you could actually do this after running the build below).
-Use the CVS tag command to add the tag to both repositories (/java and /test).
+Use the Subversion tag command to add the tag to both repositories (/java and /test).
The tag name should be something like 'xalan-j_2_4'; look at the log of any file
to see the exact format of previous builds.</p>
@@ -317,7 +317,7 @@
outbound to some server that you've copied them to.</p>
<p>(Subject to change as www.apache.org/dist gets ready for mirroring)
You'll need to log on to xml.apache.org (which is a separate machine
-from cvs.apache.org) and upload the files to /www/xml.apache.org/xalan-j/dist</p>
+from svn.apache.org) and upload the files to /www/xml.apache.org/xalan-j/dist</p>
<p>You should also update the distribution directory's html files
to note the new build numbers. Carefully edit the .htaccess file
to update the 'Latest Stable Build' and 'Latest Developers Build' lines
diff --git a/xdocs/sources/xalan/downloads.xml b/xdocs/sources/xalan/downloads.xml
index 6d86af5..8d4d9ac 100644
--- a/xdocs/sources/xalan/downloads.xml
+++ b/xdocs/sources/xalan/downloads.xml
@@ -86,7 +86,7 @@
if you downloaded a source distribution,
you have the option to use Ant to build &xslt4j;,
including <code>xalan.jar</code>, <code>xsltc.jar</code>, <code>serializer.jar</code>
- and other things, see <link anchor="using-ant">Using ant</link> for more
+ and other things, see <link anchor="using-ant">Using Ant</link> for more
details.
</p>
diff --git a/xdocs/sources/xalan/readme.xml b/xdocs/sources/xalan/readme.xml
index 52405c4..48b2910 100644
--- a/xdocs/sources/xalan/readme.xml
+++ b/xdocs/sources/xalan/readme.xml
@@ -21,7 +21,8 @@
<!-- $Id$ -->
<s1 title="Release Notes">
<ul>
- <li><link anchor="notes_latest">Release notes for version 2.7.1</link></li>
+ <li><link anchor="notes_latest">Release notes for version 2.7.2</link></li>
+ <li><link anchor="notes_271">Release notes for version 2.7.1</link></li>
<li><link anchor="notes_270">Release notes for version 2.7.0</link></li>
<li><link anchor="notes_260">Release notes for version 2.6.0</link></li>
<li><link anchor="notes_252">Release notes for version 2.5.2</link></li>
@@ -33,7 +34,74 @@
<li><link anchor="other">Other points of interest</link></li>
</ul>
- <anchor name="notes_latest"/>
+ <anchor name="notes_latest"/>
+ <s2 title="Release notes for &xslt4j; 2.7.2">
+ <p>
+ &xslt4j; 2.7.2 was released in April 2014.
+ </p>
+
+ <s3 title="Fix for CVE-2014-0107 insufficient secure processing">
+ <p>
+ When using FEATURE_SECURE_PROCESSING ("http://javax.xml.XMLConstants/feature/secure-processing") on a TransformerFactory, the output properties:
+ </p>
+ <ul>
+ <li>{http://xml.apache.org/xalan}content-handler</li>
+ <li>{http://xml.apache.org/xalan}entities</li>
+ <li>{http://xml.apache.org/xslt}content-handler</li>
+ <li>{http://xml.apache.org/xslt}entities</li>
+ </ul>
+ <p>
+ should be ignored (see http://xml.apache.org/xalan-j/usagepatterns.html#outputprops)
+ </p>
+ <p>
+ These properties can be used to load an arbitrary class or access an arbitrary URL/resource so are problematic when secure processing is desired.
+ </p>
+ <p>
+ <code>
+ <xsl:output xalan:content-handler="org.example.BadClass" ...
+ </code>
+ </p>
+ <p>
+ <code>
+ <xsl:output xalan:entities="http://example.org/reallyLargeFile.bin" ...
+ </code>
+ </p>
+ <p>
+ These features could be used to load a class that had undesirable side-effects or to load a large file and exhaust memory, etc.
+ </p>
+ <p>
+ See <link anchor="https://issues.apache.org/jira/browse/XALANJ-2435">XALANJ-2435</link>.
+ </p>
+ </s3>
+
+ <s3 title="Upgrade to Xerces-J 2.11.0 and XML Commons External 1.4.01">
+ The distributions contain upgraded versions of <code>xercesImpl.jar</code>
+ (Xerces-J 2.11.0) and <code>xml-apis.jar</code> (XML Commons External 1.4.01).
+ </s3>
+
+ <s3 title="XALANJ Jira bug fixes">
+ <p>XALANJ Jira bug fixes:
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2435">2435</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2580">2580</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2546">2546</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2581">2581</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2581">2582</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2581">2583</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2473">2473</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2495">2495</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2493">2493</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2424">2424</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2446">2446</jump>,
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2447">2447</jump>
+ </p>
+ <p>You can also view the list in
+ <jump href="https://issues.apache.org/jira/browse/XALANJ-2424?jql=project%20%3D%20XALANJ%20AND%20fixVersion%20%3D%202.7.2%20ORDER%20BY%20due%20ASC%2C%20priority%20DESC%2C%20created%20ASC">Jira</jump>
+ </p>
+ </s3>
+
+ </s2>
+
+ <anchor name="notes_271"/>
<s2 title="Release notes for &xslt4j; 2.7.1">
<p>&xslt4j; 2.7.1 was released in August 2007.
</p>
diff --git a/xdocs/sources/xalan/resources.xml b/xdocs/sources/xalan/resources.xml
index f3d5e2b..3ea604d 100644
--- a/xdocs/sources/xalan/resources.xml
+++ b/xdocs/sources/xalan/resources.xml
@@ -31,14 +31,14 @@
<resources>
<resource id="xslt4j"
title="&xslt4j;"
- location="http://xalan.apache.org/old/xalan-j"/>
+ location="http://xml.apache.org/xalan-j"/>
<resource id="xslt4j-current"
title="&xslt4j-current;"
- location="http://xalan.apache.org/old/xalan-j"/>
+ location="http://xml.apache.org/xalan-j"/>
<resource id="xslt4j-distdir"
title="xalan-j distribution directory"
- location="http://www.apache.org/dyn/closer.cgi/xalan/xalan-j"/>
+ location="http://www.apache.org/dyn/closer.cgi/xml/xalan-j"/>
<resource id="xslt4j-distdir-previous"
title="xalan-j archive directory"
@@ -49,12 +49,12 @@
location="http://xerces.apache.org/xerces2-j/index.html"/>
<resource id="xml4j-distdir"
title="xerces-j distribution directory"
- location="http://archive.apache.org/dist/xml/xerces-j/"/>
+ location="http://www.apache.org/dyn/closer.cgi/xml/xerces-j/"/>
<resource id="ant" title="Ant"
location="http://jakarta.apache.org/ant/index.html"/>
<resource id="ApacheLicense"
title="The Apache Software License, Version 1.1"
- location="http://xalan.apache.org/dist/LICENSE.txt"/>
+ location="http://xml.apache.org/dist/LICENSE.txt"/>
<resource id="jira"
title="JIRA (the Apache issue tracker)"
location="http://issues.apache.org/jira/browse/XALANJ"/>
@@ -146,7 +146,7 @@
<human-resource id="xalandev"
name="Xalan Development Mailing List"
- mailto="dev@xalan.apache.org"/>
+ mailto="xalan-dev@xml.apache.org"/>
<human-resource id="sboag"
name="Scott Boag"
diff --git a/xdocs/sources/xalan/whatsnew.xml b/xdocs/sources/xalan/whatsnew.xml
index 505218b..3aa762b 100644
--- a/xdocs/sources/xalan/whatsnew.xml
+++ b/xdocs/sources/xalan/whatsnew.xml
@@ -20,37 +20,54 @@
<s1 title="What's new in &xslt4j2;">
<s2 title="What's new in &xslt4j-current;">
-<p> </p>
+ <p>
+ Here's what new in &xslt4j-current;.
+ </p>
- <s3 title="Support for DOM Level 3 serialization (LSSerializer)">
+ <s3 title="Fix for CVE-2014-0107 insufficient secure processing">
<p>
- The serializer now has support for DOM Level 3 serialization
- (<jump href="http://www.w3.org/TR/2004/REC-DOM-Level-3-LS-20040407/load-save.html#LS-LSSerializer">LSSerializer</jump>)
- for an XML parser. These changes are seen in the new class
- <jump href="apidocs/org/apache/xml/serializer/DOM3Serializer.html">
- <code>org.apache.xml.serializer.DOM3Serializer</code></jump>
- and the new package
- <code>org.apache.xml.serializer.dom3</code>
- as well as a new method,
- <code>asDOM3Serializer()</code> on the older
- <jump href="apidocs/org/apache/xml/serializer/Serializer.html">
- <code>org.apache.xml.serializer.Serializer</code></jump> interface.
+ When using FEATURE_SECURE_PROCESSING ("http://javax.xml.XMLConstants/feature/secure-processing") on a TransformerFactory, the output properties:
+ </p>
+ <ul>
+ <li>{http://xml.apache.org/xalan}content-handler</li>
+ <li>{http://xml.apache.org/xalan}entities</li>
+ <li>{http://xml.apache.org/xslt}content-handler</li>
+ <li>{http://xml.apache.org/xslt}entities</li>
+ </ul>
+ <p>
+ should be ignored (see http://xml.apache.org/xalan-j/usagepatterns.html#outputprops)
</p>
<p>
- More details are in the javadoc of those classes and interfaces
+ These properties can be used to load an arbitrary class or access an arbitrary URL/resource so are problematic when secure processing is desired.
+ </p>
+ <p>
+ <code>
+ <xsl:output xalan:content-handler="org.example.BadClass" ...
+ </code>
+ </p>
+ <p>
+ <code>
+ <xsl:output xalan:entities="http://example.org/reallyLargeFile.bin" ...
+ </code>
+ </p>
+ <p>
+ These features could be used to load a class that had undesirable side-effects or to load a large file and exhaust memory, etc.
+ </p>
+ <p>
+ See <link anchor="https://issues.apache.org/jira/browse/XALANJ-2435">XALANJ-2435</link>.
</p>
</s3>
- <s3 title="Upgrade to Xerces-J 2.9.0 and XML Commons External 1.3.04.">
- The distributions contain upgraded versions of <code>xml-apis.jar</code>
- (Xerces-J 2.9.0) and <code>xml-apis.jar</code> (XML Commons External 1.3.04).
+ <s3 title="Upgrade to Xerces-J 2.11.0 and XML Commons External 1.4.01">
+ The distributions contain upgraded versions of <code>xercesImpl.jar</code>
+ (Xerces-J 2.11.0) and <code>xml-apis.jar</code> (XML Commons External 1.4.01).
</s3>
<s3 title="Bug fixes">
- Of course the 2.7.1 release contains performance enhancements
- and other bug fixes since 2.7.0 and a list of these can be found in
- <link idref="readme" anchor="notes_latest">the release notes</link>.
+ &xslt4j-current; contains performance enhancements and other bug fixes since 2.7.1. You can find the list
+ in <link idref="readme" anchor="notes_latest">the release notes</link>.
</s3>
</s2>
+
</s1>
diff --git a/xdocs/sources/xsltc.xml b/xdocs/sources/xsltc.xml
index 37c439a..2fcc0f2 100644
--- a/xdocs/sources/xsltc.xml
+++ b/xdocs/sources/xsltc.xml
@@ -16,7 +16,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
-->
-<book title="XSLTC Design" copyright="1999-2012 The Apache Software Foundation">
+<book title="XSLTC Design" copyright="1999-2014 The Apache Software Foundation">
<document id="index"
label="Overview"
