Skip to content

Release 1.3.2

Choose a tag to compare

View all tags
@clauret clauret released this 16 Feb 10:59
· 85 commits to main since this release
v1.3.2
123cbc2

Highlights

This release strengthens XML parsing security (notably around XXE/entity expansion), improves loader extensibility via custom TextTokenizer support, and includes internal refactors for cleaner, more maintainable loader implementations.

New Features

  • Consistent token sourcing in matching logic: matching tokens are now consistently taken from the to sequence (instead of from) to ensure predictable behavior.
  • Custom TextTokenizer support across all loaders: all loader implementations can now be configured with a custom TextTokenizer to allow loaders to generate different TextToken depending on their requirements

Security / Hardening

  • XXE and entity expansion protections
    • SAXLoader hardening: improved default XMLReader factory behavior and XXE prevention.
    • DOMLoader: prevents entity expansion (note: this may be behavior-changing in some XML inputs).

Improvements

  • Documentation updates: improved XMLLoader Javadoc with clearer guidance on usage and thread-safety expectations.

Refactoring & Maintenance

  • Extracted LoadSession from DOMLoader to improve separation of concerns and modularity.
  • XMLEventLoader now reuses an existing textTokenizer when available.
  • Added support for a custom XMLReader factory in SAXLoader.

Potential Breaking Changes / Migration Notes

  • DOMLoader entity expansion disabled
    • If you previously relied on expanded entities during DOM loading, behavior may differ. Consider adjusting input XML or parser configuration accordingly.
  • Matching tokens now sourced from to
    • If downstream logic implicitly depended on the old from-sourced behavior, validate matching results after upgrading.

Full Changelog: v1.3.1...v1.3.2

Assets 2
Loading