[java-opensaml] 02/02: Extend warning in javadoc.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=d3307d8fb0e0396fcb534fa88e03d9b345489c7a

commit d3307d8fb0e0396fcb534fa88e03d9b345489c7a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Feb 28 19:19:55 2018 -0500

    Extend warning in javadoc.
---
 .../opensaml/core/xml/io/AbstractXMLObjectUnmarshaller.java   | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/opensaml-core/src/main/java/org/opensaml/core/xml/io/AbstractXMLObjectUnmarshaller.java b/opensaml-core/src/main/java/org/opensaml/core/xml/io/AbstractXMLObjectUnmarshaller.java
index 3b5087b..d9d390e 100644
--- a/opensaml-core/src/main/java/org/opensaml/core/xml/io/AbstractXMLObjectUnmarshaller.java
+++ b/opensaml-core/src/main/java/org/opensaml/core/xml/io/AbstractXMLObjectUnmarshaller.java
@@ -43,17 +43,20 @@ import org.w3c.dom.Node;
 import org.w3c.dom.Text;
 
 /**
- * An thread safe abstract unmarshaller. This unmarshaller will:
+ * A thread safe abstract unmarshaller. This unmarshaller will:
  * <ul>
  * <li>Unmarshalling namespace declaration attributes</li>
  * <li>Unmarshalling schema instance type (xsi:type) declaration attributes</li>
  * <li>Delegating to child classes element, text, and attribute processing</li>
  * </ul>
  * 
- * <strong>NOTE:</strong> In the case of Text nodes this unmarshaller will use {@link org.w3c.dom.Text#getWholeText()}
- * to retrieve the textual content. This is probably exceptable in almost all cases, if, however, you need to deal with
- * elements that contain multiple text node children you will need to override
+ * <strong>WARNING:</strong> In the case of Text nodes this unmarshaller will use {@link org.w3c.dom.Text#getWholeText()}
+ * to retrieve the content. This is acceptable if and only if our XML parsing classes are used in their default (safe)
+ * configuration on the Java platforms we officially support. If you need to deal with elements that contain multiple
+ * text node children, or you intend to rely on your own XML parser and/or JAXP implementation, you will need to override
  * {@link #unmarshallTextContent(XMLObject, Text)} and do "the right thing" for your implementation.
+ * 
+ * Failure to adhere to this warning will very likely lead to security bugs.
  */
 public abstract class AbstractXMLObjectUnmarshaller implements Unmarshaller {
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.