<?xml version="1.0" encoding="UTF-8"?>

<!--

Licensed to the Apache Software Foundation (ASF) under one or more

contributor license agreements. See the NOTICE file distributed with

this work for additional information regarding copyright ownership.

The ASF licenses this file to You under the Apache License, Version 2.0

(the "License"); you may not use this file except in compliance with

the License. You may obtain a copy of the License at

https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

-->

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>

<parent>

<groupId>org.apache.commons</groupId>

<artifactId>commons-parent</artifactId>

<version>103</version>

</parent>

<artifactId>commons-xml</artifactId>

<version>0.1.0-SNAPSHOT</version>

<name>Apache Commons XML</name>

<url>https://commons.apache.org/sandbox/commons-xml/</url>

<inceptionYear>2026</inceptionYear>

<description>Apache Commons XML provides secure-by-default JAXP factory creation, abstracting over

implementation-specific XXE hardening differences between the stock JDK and external JAXP implementations

(Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE).</description>

<scm>

<connection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</connection>

<developerConnection>scm:git:https://gitbox.apache.org/repos/asf/commons-xml.git</developerConnection>

<url>https://gitbox.apache.org/repos/asf?p=commons-xml.git</url>

<tag>rel/commons-xml-${project.version}</tag>

</scm>

<properties>

<!-- Release-related properties -->

<commons.release.version>0.1.0</commons.release.version>

<commons.release.desc>(Java 8+)</commons.release.desc>

<commons.rc.version>RC1</commons.rc.version>

<!-- japicmp baseline: disable for first release

<commons.bc.version>0.1.1</commons.bc.version> -->

<japicmp.skip>true</japicmp.skip>

<commons.release.next>0.1.2</commons.release.next>

<commons.componentid>xml</commons.componentid>

<commons.packageId>xml</commons.packageId>

<commons.module.name>org.apache.commons.xml</commons.module.name>

<commons.jira.id>COMMONSXML</commons.jira.id>

<!-- Sandbox component: publish the site under the sandbox tree (the parent defaults to proper/). -->

<commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/sandbox/commons-xml</commons.scmPubUrl>

<!-- OSGi bundle metadata: override commons-parent's org.apache.commons.* defaults. -->

<commons.osgi.symbolicName>org.apache.commons.xml</commons.osgi.symbolicName>

<commons.osgi.export>org.apache.commons.xml.*;version=${project.version};-noimport:=true</commons.osgi.export>

<commons.osgi.import>

net.sf.saxon.*;resolution:=optional,

org.apache.xerces.*;resolution:=optional,

*

</commons.osgi.import>

<project.build.outputTimestamp>2026-04-22T00:00:00Z</project.build.outputTimestamp>

<!-- Java baseline -->

<maven.compiler.source>1.8</maven.compiler.source>

<maven.compiler.target>1.8</maven.compiler.target>

<!-- GraalVM native-image tooling; used by the `native-xalan` profile only. -->

<commons.graalvm.buildtools.version>1.1.3</commons.graalvm.buildtools.version>

<!-- Optional JAXP implementations used by bundled providers. -->

<commons.saxon.version>12.9</commons.saxon.version>

<commons.woodstox.version>7.1.1</commons.woodstox.version>

<commons.xalan.version>2.7.3</commons.xalan.version>

<commons.xerces.version>2.12.2</commons.xerces.version>

</properties>

<dependencies>

<!--

Saxon-HE supplies types we reference at compile time (the Saxon provider). It is not part of the consumer

contract: it is declared in provided scope, so callers who want Saxon-HE for XSLT/XPath bring it themselves

and it is never pulled in transitively.

-->

<dependency>

<groupId>net.sf.saxon</groupId>

<artifactId>Saxon-HE</artifactId>

<version>${commons.saxon.version}</version>

<scope>provided</scope>

</dependency>

<dependency>

<groupId>org.junit.jupiter</groupId>

<artifactId>junit-jupiter</artifactId>

<scope>test</scope>

</dependency>

</dependencies>

<build>

<defaultGoal>clean checkstyle:check spotbugs:check pmd:check javadoc:javadoc verify</defaultGoal>

<pluginManagement>

<plugins>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-checkstyle-plugin</artifactId>

<configuration>

<configLocation>${basedir}/src/conf/checkstyle.xml</configLocation>

<enableRulesSummary>false</enableRulesSummary>

<!-- Later:

<includeTestSourceDirectory>true</includeTestSourceDirectory> -->

</configuration>

</plugin>

<plugin>

<groupId>com.github.spotbugs</groupId>

<artifactId>spotbugs-maven-plugin</artifactId>

<configuration>

<excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>

</configuration>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-pmd-plugin</artifactId>

<configuration>

<rulesets>

<ruleset>src/conf/maven-pmd-plugin.xml</ruleset>

</rulesets>

</configuration>

</plugin>

</plugins>

</pluginManagement>

<plugins>

<!--

Run the test suite seven times, each with a distinct JAXP combination:

- test-saxon: Saxon-HE (TrAX, XPath) over stock JDK SAX

- test-saxon-xerces: Saxon-HE (TrAX, XPath) over stock JDK SAX or Apache Xerces SAX

(Saxon prefers the JDK SAX provider but may resolve to Xerces)

- test-stockjdk: stock JDK factories only (every group except xpath3)

- test-woodstox: Woodstox (StAX)

- test-xalan: Apache Xalan (TrAX, XPath) over stock JDK SAX

- test-xalan-xerces: Apache Xalan (TrAX, XPath) over Apache Xerces SAX

- test-xerces: Apache Xerces (DOM, SAX, Schema)

-->

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-surefire-plugin</artifactId>

<!--

Make the underlying JAXP factories as permissive as the JDK allows. Hardened factories produced by

XmlFactories should still block every attack the test suite throws at them; if a test passes only

because the JDK's defaults intervened, we want it to fail here so the gap shows up.

Inherited by every execution defined below.

-->

<configuration>

<systemPropertyVariables>

<!-- Allow all protocols for external DTDs, schemas, and stylesheets. -->

<javax.xml.accessExternalDTD>all</javax.xml.accessExternalDTD>

<javax.xml.accessExternalSchema>all</javax.xml.accessExternalSchema>

<javax.xml.accessExternalStylesheet>all</javax.xml.accessExternalStylesheet>

</systemPropertyVariables>

</configuration>

<executions>

<execution>

<id>default-test</id>

<phase>none</phase>

</execution>

<execution>

<id>test-saxon</id>

<goals>

<goal>test</goal>

</goals>

<configuration>

<reportsDirectory>${project.build.directory}/surefire-reports/saxon</reportsDirectory>

<!-- Saxon contributes TrAX (transformer + stylesheet) and XPath; xpath3 covers Saxon-only XPath 3.1 functions. -->

<groups>trax,xpath3</groups>

</configuration>

</execution>

<execution>

<id>test-saxon-xerces</id>

<goals>

<goal>test</goal>

</goals>

<configuration>

<reportsDirectory>${project.build.directory}/surefire-reports/saxon-xerces</reportsDirectory>

<!-- Same groups as test-saxon, but with Apache Xerces also visible to Saxon's SAX-provider lookup. -->

<groups>trax,xpath3</groups>

<additionalClasspathDependencies>

<dependency>

<groupId>xerces</groupId>

<artifactId>xercesImpl</artifactId>

<version>${commons.xerces.version}</version>

</dependency>

</additionalClasspathDependencies>

</configuration>

</execution>

<execution>

<id>test-stockjdk</id>

<goals>

<goal>test</goal>

</goals>

<configuration>

<reportsDirectory>${project.build.directory}/surefire-reports/stockjdk</reportsDirectory>

<!-- Run every tagged and untagged test except xpath3, which needs Saxon on the classpath. -->

<excludedGroups>xpath3</excludedGroups>

<classpathDependencyExcludes>

<exclude>net.sf.saxon:Saxon-HE</exclude>

</classpathDependencyExcludes>

</configuration>

</execution>

<execution>

<id>test-woodstox</id>

<goals>

<goal>test</goal>

</goals>

<configuration>

<reportsDirectory>${project.build.directory}/surefire-reports/woodstox</reportsDirectory>

<!-- Woodstox only contributes StAX. -->

<groups>stax</groups>

<additionalClasspathDependencies>

<dependency>

<groupId>com.fasterxml.woodstox</groupId>

<artifactId>woodstox-core</artifactId>

<version>${commons.woodstox.version}</version>

</dependency>

</additionalClasspathDependencies>

<classpathDependencyExcludes>

<exclude>net.sf.saxon:Saxon-HE</exclude>

</classpathDependencyExcludes>

</configuration>

</execution>

<execution>

<id>test-xalan</id>

<goals>

<goal>test</goal>

</goals>

<configuration>

<reportsDirectory>${project.build.directory}/surefire-reports/xalan</reportsDirectory>

<!-- Xalan contributes TrAX and XPath. -->

<groups>xpath,trax</groups>

<additionalClasspathDependencies>

<dependency>

<groupId>xalan</groupId>

<artifactId>serializer</artifactId>

<version>${commons.xalan.version}</version>

</dependency>

<dependency>

<groupId>xalan</groupId>

<artifactId>xalan</artifactId>

<version>${commons.xalan.version}</version>

</dependency>

</additionalClasspathDependencies>

<classpathDependencyExcludes>

<exclude>net.sf.saxon:Saxon-HE</exclude>

</classpathDependencyExcludes>

</configuration>

</execution>

<execution>

<id>test-xalan-xerces</id>

<goals>

<goal>test</goal>

</goals>

<configuration>

<reportsDirectory>${project.build.directory}/surefire-reports/xalan-xerces</reportsDirectory>

<!-- Same groups as test-xalan, but with Apache Xerces winning Xalan's internal SAX-provider lookup. -->

<groups>xpath,trax</groups>

<additionalClasspathDependencies>

<dependency>

<groupId>xalan</groupId>

<artifactId>serializer</artifactId>

<version>${commons.xalan.version}</version>

</dependency>

<dependency>

<groupId>xalan</groupId>

<artifactId>xalan</artifactId>

<version>${commons.xalan.version}</version>

</dependency>

<dependency>

<groupId>xerces</groupId>

<artifactId>xercesImpl</artifactId>

<version>${commons.xerces.version}</version>

</dependency>

</additionalClasspathDependencies>

<classpathDependencyExcludes>

<exclude>net.sf.saxon:Saxon-HE</exclude>

</classpathDependencyExcludes>

</configuration>

</execution>

<execution>

<id>test-xerces</id>

<goals>

<goal>test</goal>

</goals>

<configuration>

<reportsDirectory>${project.build.directory}/surefire-reports/xerces</reportsDirectory>

<!-- Xerces only contributes DOM/SAX/Schema; the rest is JDK-bundled and already covered by test-stockjdk. -->

<groups>dom,sax,schema</groups>

<additionalClasspathDependencies>

<dependency>

<groupId>xerces</groupId>

<artifactId>xercesImpl</artifactId>

<version>${commons.xerces.version}</version>

</dependency>

</additionalClasspathDependencies>

<classpathDependencyExcludes>

<exclude>net.sf.saxon:Saxon-HE</exclude>

</classpathDependencyExcludes>

</configuration>

</execution>

</executions>

</plugin>

<!-- Do not publish a test-jar: the test classes are not part of the consumer contract. -->

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-jar-plugin</artifactId>

<executions>

<execution>

<id>default</id>

<phase>none</phase>

</execution>

</executions>

</plugin>

<!--

commons-parent's create-source-jar execution attaches both the main sources (jar-no-fork) and the test

sources (test-jar-no-fork) in one execution. Disable it and re-bind a main-sources-only execution, so the

published artifact keeps the required sources jar but drops the test-sources jar.

-->

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-source-plugin</artifactId>

<executions>

<execution>

<id>create-source-jar</id>

<phase>none</phase>

</execution>

<execution>

<id>create-main-source-jar</id>

<phase>package</phase>

<goals>

<goal>jar-no-fork</goal>

</goals>

</execution>

</executions>

</plugin>

<!-- jdeps makes Saxon.HE a hard requires; flip it to static (optional). The trailing * keeps the rest. -->

<plugin>

<groupId>org.moditect</groupId>

<artifactId>moditect-maven-plugin</artifactId>

<executions>

<execution>

<id>add-module-infos</id>

<configuration>

<module>

<moduleInfo>

<requires>

static Saxon.HE;

*;

</requires>

</moduleInfo>

</module>

</configuration>

</execution>

</executions>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-checkstyle-plugin</artifactId>

</plugin>

</plugins>

</build>

<reporting>

<plugins>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-checkstyle-plugin</artifactId>

</plugin>

<plugin>

<groupId>com.github.spotbugs</groupId>

<artifactId>spotbugs-maven-plugin</artifactId>

<configuration>

<excludeFilterFile>${basedir}/src/conf/spotbugs-exclude-filter.xml</excludeFilterFile>

</configuration>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-pmd-plugin</artifactId>

<configuration>

<rulesets>

<ruleset>src/conf/maven-pmd-plugin.xml</ruleset>

</rulesets>

</configuration>

</plugin>

</plugins>

</reporting>

<profiles>

<!--

Regression guard for the generated OSGi and JPMS descriptors.

The JPMS test requires JDK 9+

-->

<profile>

<id>java11-tests</id>

<activation>

<jdk>[11,)</jdk>

</activation>

<build>

<plugins>

<!-- Compile the src/test/java11 source root at release 11; the default test sources stay at release 8. -->

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-compiler-plugin</artifactId>

<executions>

<execution>

<id>testCompile-java11</id>

<phase>test-compile</phase>

<goals>

<goal>testCompile</goal>

</goals>

<configuration>

<release>11</release>

<compileSourceRoots>

<compileSourceRoot>${project.basedir}/src/test/java11</compileSourceRoot>

</compileSourceRoots>

</configuration>

</execution>

</executions>

</plugin>

<!-- Run DescriptorIT against the packaged jar; no OSGi framework or separate JPMS module needed. -->

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-failsafe-plugin</artifactId>

<executions>

<execution>

<id>verify-descriptors</id>

<goals>

<goal>integration-test</goal>

<goal>verify</goal>

</goals>

<configuration>

<systemPropertyVariables>

<buildJar>${project.build.directory}/${project.build.finalName}.jar</buildJar>

</systemPropertyVariables>

</configuration>

</execution>

</executions>

</plugin>

</plugins>

</build>

</profile>

<!--

Dependency versions only compatible with JDK 17+.

-->

<profile>

<id>java17-dependencies</id>

<activation>

<jdk>[17,)</jdk>

</activation>

<properties>

<commons.saxon.version>13.0</commons.saxon.version>

</properties>

</profile>

<!--

Runs the test suite as a GraalVM native image; activate with -Pnative-xalan on a GraalVM JDK.

Worth a job because native-image resolves JAXP providers under the closed-world assumption: the lookup a JVM

performs at run time through ServiceLoader is decided at build time instead.

A native binary carries one classpath, so only `test-stockjdk` runs; the other JAXP combinations stay on the

JVM matrix. Its `xpath3` group is excluded there already, and that group needs Saxon, which is dropped here.

-->

<profile>

<id>native-xalan</id>

<dependencies>

<dependency>

<groupId>org.graalvm.buildtools</groupId>

<artifactId>junit-platform-native</artifactId>

<version>${commons.graalvm.buildtools.version}</version>

<scope>test</scope>

</dependency>

<!--

Apache Xalan supplies TrAX. The stock JDK's XSLTC compiles each stylesheet into translet bytecode and

defines the class at run time, which a closed-world image cannot do; Xalan interprets instead. Declared as

project dependencies, not surefire's additionalClasspathDependencies, which native-image never sees.

-->

<dependency>

<groupId>xalan</groupId>

<artifactId>xalan</artifactId>

<version>${commons.xalan.version}</version>

<scope>test</scope>

</dependency>

<dependency>

<groupId>xalan</groupId>

<artifactId>serializer</artifactId>

<version>${commons.xalan.version}</version>

<scope>test</scope>

</dependency>

</dependencies>

<build>

<plugins>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-surefire-plugin</artifactId>

<executions>

<!--

Only `test-stockjdk` is left running, unconfigured: it registers the tests the native binary replays.

The profile's Xalan dependencies are on its classpath, so it is Xalan, not XSLTC, that supplies TrAX

in both the JVM and the native run.

Every other execution is silenced; their classpath swaps have no native equivalent.

-->

<execution>

<id>test-xalan</id>

<phase>none</phase>

</execution>

<execution>

<id>test-saxon</id>

<phase>none</phase>

</execution>

<execution>

<id>test-saxon-xerces</id>

<phase>none</phase>

</execution>

<execution>

<id>test-woodstox</id>

<phase>none</phase>

</execution>

<execution>

<id>test-xalan-xerces</id>

<phase>none</phase>

</execution>

<execution>

<id>test-xerces</id>

<phase>none</phase>

</execution>

</executions>

</plugin>

<plugin>

<groupId>org.graalvm.buildtools</groupId>

<artifactId>native-maven-plugin</artifactId>

<version>${commons.graalvm.buildtools.version}</version>

<extensions>true</extensions>

<configuration>

<!-- The bundled metadata pins older JUnit versions, whose class-initialization directives

conflict with the JUnit this project resolves. -->

<metadataRepository>

<enabled>false</enabled>

</metadataRepository>

<!-- Xalan reflects on org.apache.xalan.templates.* setters and reads its serializer defaults from

property files; static analysis sees none of it. The agent records what the JVM run touched, and

the native binary replays those same tests, so the metadata covers it by construction. -->

<agent>

<enabled>true</enabled>

</agent>

<!-- Match `test-stockjdk`, which drops Saxon-HE. Saxon's JAXP entry points carry no reachability

metadata, so every ServiceLoader lookup would fail on a missing no-arg constructor. -->

<exclusions>

<exclusion>

<groupId>net.sf.saxon</groupId>

<artifactId>Saxon-HE</artifactId>

</exclusion>

</exclusions>

<buildArgs>

<!-- The JUnit platform feature discovers tests while the image is built, which initializes TestTag. -->

<buildArg>--initialize-at-build-time=org.junit.platform.engine.TestTag</buildArg>

<!-- Embed the fixtures explicitly: the agent records only resources a run actually opened. -->

<buildArg>-H:IncludeResources=leaked/.*</buildArg>

</buildArgs>

</configuration>

<executions>

<execution>

<id>test-native</id>

<phase>test</phase>

<goals>

<goal>test</goal>

</goals>

</execution>

</executions>

</plugin>

</plugins>

</build>

</profile>

</profiles>

<developers>

<developer>

<id>ppkarwasz</id>

<name>Piotr P. Karwasz</name>

<email>pkarwasz-pom@apache.org</email>

</developer>

<developer>

<id>ggregory</id>

<name>Gary Gregory</name>

<email>ggregory at apache.org</email>

<url>https://www.garygregory.com</url>

<organization>The Apache Software Foundation</organization>

<organizationUrl>https://www.apache.org/</organizationUrl>

<roles>

<role>PMC Member</role>

</roles>

<timezone>America/New_York</timezone>

<properties>

<picUrl>https://people.apache.org/~ggregory/img/garydgregory80.png</picUrl>

</properties>

</developer>

</developers>

</project>