Recognize classes used in web.xml as main classes #264
Conversation
A web application may include classes provided by dependency artifacts. Class references defined in web.xml are now recognized as main used classes.
| throws IOException, SAXException, XPathExpressionException, ParserConfigurationException { | ||
|
|
||
| DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); | ||
| documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); |
There was a problem hiding this comment.
I think you need to set the namespace feature to true here
There was a problem hiding this comment.
when I set:
documentBuilderFactory.setNamespaceAware(true);
xpath stops working .... we can have web.xml in both namespace ... javaee - old and jakartaee
it will be more complicated to build xpath
There was a problem hiding this comment.
If the the xpath stops working, then the xpath is wrong. You likely have two errors that are cancelling each other out, but that's very brittle.
web.xml in both namespaces is a problem, and that's a big reason not to change namespaces with new versions. It causes exactly this sort of problem.
You can match on the local-name() instead or rearrange the code to use separate paths for the two different namespaces.
There was a problem hiding this comment.
done use namespace with local-name
|
|
||
| try { | ||
| return processWebXml(webXml, excludedClasses); | ||
| } catch (ParserConfigurationException | XPathExpressionException e) { |
There was a problem hiding this comment.
I think both of these would indicate a bug in the code. IN the the XPath case that's because the XPath expression is fully within this code and not passed in from the environment. Assuming I'm right about that, this could reasonably be a runtime exception.
There was a problem hiding this comment.
We have already IOException in method definition so can be used ... I can change to runtime ... but will be the same
as you write such exceptions should not occur at all
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
| throws IOException, SAXException, XPathExpressionException, ParserConfigurationException { | ||
|
|
||
| DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); | ||
| documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); |
There was a problem hiding this comment.
If the the xpath stops working, then the xpath is wrong. You likely have two errors that are cancelling each other out, but that's very brittle.
web.xml in both namespaces is a problem, and that's a big reason not to change namespaces with new versions. It causes exactly this sort of problem.
You can match on the local-name() instead or rearrange the code to use separate paths for the two different namespaces.
| private XPathExpression[] getXPathExpression() throws XPathExpressionException { | ||
| XPathFactory xPathFactory = XPathFactory.newInstance(); | ||
| XPath xpath = xPathFactory.newXPath(); | ||
| return new XPathExpression[] { |
There was a problem hiding this comment.
Just noticed you have multiple XPath expressions here already, so you probably should just double them up, one for each namespace. You will need to provide a NamespaceContext object that binds the prefixes you use here to the actual namespace URIs.
There was a problem hiding this comment.
When I use local-name I don't need a NamespaceContext.
I don't want to complicate it so much.
Goal is to take some values from web.xml not verifying it.
In case of wrong namespaces, missing namespaces in web.xml I don't want to break a build it and so ...
There was a problem hiding this comment.
I did as you propose:
You can match on the local-name() instead or rearrange the code to use separate paths for the two different namespaces.
2 participants
A web application may include classes provided by dependency artifacts. Class references defined in web.xml are now recognized as main used classes.
Following this checklist to help us incorporate your
contribution quickly and easily:
Note that commits might be squashed by a maintainer on merge.
This may not always be possible but is a best-practice.
mvn verifyto make sure basic checks pass.A more thorough check will be performed on your pull request automatically.
mvn -Prun-its verify).If your pull request is about ~20 lines of code you don't need to sign an
Individual Contributor License Agreement if you are unsure
please ask on the developers list.
To make clear that you license your contribution under
the Apache License Version 2.0, January 2004
you have to acknowledge this by using the following check-box.