Re: Failing test - PR #581

On 4/29/26 10:58 AM, Ihor Kuzmanenko wrote:
>
> Dear maintainers,
>
>
> I stumbled upon a failing 
> test XMLParserEdgeCasesTest#testDeeplyNestedElements when ran it with 
> Java 25.
>
>
> The test fails on these lines: 
> https://github.com/apache/santuario-xml-security-java/blob/cc6c705057b4a80649a0832896fb54dc632e154a/src/test/java/org/apache/xml/security/test/dom/parser/XMLParserEdgeCasesTest.java#L152-L162
>
>
> Actually it accepts two success paths: either the exception is not 
> thrown or exception message contains one of the keywords: 'depth', 
> 'stacked', 'nested'.
>
> OpenJDK 21 has no default depth limit for XML parser, so the test passes.
>
> Starting from JDK 24+26, the default value was set to 100, so it 
> triggers the second path in the test. This can also be easily achieved 
> with JDK 21 by explicitly setting the system 
> property: jdk.xml.maxElementDepth=100
>
>
> The original SAXParseException contains word 'depth', however it is 
> rethrown as XMLParserException with a new message in XMLParserImpl, 
> see 
> https://github.com/apache/santuario-xml-security-java/blob/cc6c705057b4a80649a0832896fb54dc632e154a/src/main/java/org/apache/xml/security/parser/XMLParserImpl.java#L73
>
>
> I can suggest getting e.getCause() in the test or search for 
> substrings in e.toString() to check that the exception is caused by 
> deep nesting.
>
> Please let me know if you would like me to prepare a PR.
>
Good catch. A PR would be great.

Thanks,

Sean

>
> Thank you.
>
>
> Best regards,
>
> Ihor.
>
>