Reputation: 80
When upgrading from Xalan 2.7.0 to 2.7.3, I found that (as of 2.7.1) the transformed document no longer has a newline after the XML Declaration. The declaration is added automatically because "omit-xml-declaration" is set to "no", the default.
Here is my input document:
<?xml version="1.0" encoding="UTF-8"?>
<input-root>
<input-a id="1">
<input-b id="1">ABC</input-b>
<input-b id="2">DEF</input-b>
<input-b id="3">GHI</input-b>
<input-b id="4">JKL</input-b>
</input-a>
<input-a id="2">
<input-b id="1">MNO</input-b>
<input-b id="2">PQR</input-b>
<input-b id="4">STU</input-b>
</input-a>
</input-root>
And my stylesheet:
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:output method="xml" indent="yes"/>
<xsl:template match="/input-root">
<output-root>
<xsl:for-each select="input-a">
<output-a>
<xsl:attribute name="id">
<xsl:value-of select="@id"/>
</xsl:attribute>
<xsl:for-each select="input-b">
<output-b>
<xsl:attribute name="id">
<xsl:value-of select="@id"/>
</xsl:attribute>
<xsl:value-of select="text()"/>
</output-b>
</xsl:for-each>
</output-a>
</xsl:for-each>
</output-root>
</xsl:template>
</xsl:stylesheet>
The expected output is:
<?xml version="1.0" encoding="UTF-8"?>
<output-root>
<output-a id="1">
<output-b id="1">ABC</output-b>
<output-b id="2">DEF</output-b>
<output-b id="3">GHI</output-b>
<output-b id="4">JKL</output-b>
</output-a>
<output-a id="2">
<output-b id="1">MNO</output-b>
<output-b id="2">PQR</output-b>
<output-b id="4">STU</output-b>
</output-a>
</output-root>
Xalan-J versions 2.7.0 and prior produce this output. As of 2.7.1, the output now looks like:
<?xml version="1.0" encoding="UTF-8"?><output-root>
<output-a id="1">
<output-b id="1">ABC</output-b>
<output-b id="2">DEF</output-b>
<output-b id="3">GHI</output-b>
<output-b id="4">JKL</output-b>
</output-a>
<output-a id="2">
<output-b id="1">MNO</output-b>
<output-b id="2">PQR</output-b>
<output-b id="4">STU</output-b>
</output-a>
</output-root>
On the surface this looks like not a major problem. It is valid XML and all. Unfortunately, the production application generates lots of different XML documents using transforms and our trading partners expect things to not change.
Due to CVE-2022-34169, it is necessary to update.
Anyone know why the change? Any way to update but keep the prior behavior?
Upvotes: 0
Views: 34