Skip to content

Commit b39c0d3

Browse files
ndwndw
authored
Merge pull request #23 from ndw/117-128
Saxon 11.7 and 12.8
2 parents ab074a7 + 5f3d42f commit b39c0d3

3 files changed

Lines changed: 213 additions & 0 deletions

File tree

‎src/announcements/2025/07/saxon-11.7-and-12.8.html‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<html xmlns="http://www.w3.org/1999/xhtml">
3+
<head>
4+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5+
<title>Saxon 11.7 and 12.8</title>
6+
<meta name="author" content="Norm Tovey-Walsh" />
7+
<meta name="pubdate" content="2025-07-03T17:40:00" />
8+
</head>
9+
<body>
10+
<h1>Saxon 11.7 and 12.8</h1>
11+
12+
<p>The accompanying release announcements for
13+
<a href="saxon-11.7.html">Saxon 11.7</a> and
14+
<a href="saxon-12.8.html">Saxon 12.8</a> describe those
15+
releases in detail. This post summarizes why we decided that we
16+
needed to release them both this week.</p>
17+
18+
<p>Some applications are known to use Saxon to run untrusted, user-submitted
19+
stylesheets or queries. Running untrusted code always entails some risk. Saxon
20+
provides two
21+
<a href="https://www.saxonica.com/documentation12/index.html#!configuration/config-features">features</a>
22+
designed to help mitigate this risk: <code>ALLOWED_PROTOCOLS</code> and
23+
24+
<code>ALLOW_EXTERNAL_FUNCTIONS</code>. Setting <code>ALLOWED_PROTOCOLS</code>
25+
can limit what resources a stylesheet or query can access; it can for example,
26+
forbid access to file: URIs. The <code>ALLOW_EXTERNAL_FUNCTIONS</code> feature
27+
can disable access to reflexive Java extension functions, some system
28+
properties, and some other extension functions. (The remit of the
29+
<code>ALLOW_EXTERNAL_FUNCTIONS</code> feature is a little wider than you might
30+
expect.)</p>
31+
32+
<p>Unfortunately, we discovered a function in Saxon 11 and 12 that was not
33+
adequately controlled by these features. In principle, a stylesheet or query
34+
running in Saxon-PE or Saxon-EE could access the local filesystem even if the
35+
<code>ALLOWED_PROTOCOLS</code> feature was set to forbid such access. The risk
36+
is small: it only applies to untrusted code running in Saxon-PE or Saxon-EE (it
37+
does not apply to Saxon-HE) on a system where reading from the local filesystem
38+
would be deemed a risk. (We would encourage anyone running untrusted code to use
39+
a sandboxed environment where there is no data on the filesystem that needs to
40+
be protected from read access.)</p>
41+
42+
<p>Although we judge the risk to be small, At Saxonica, we take security
43+
seriously and we are publishing maintenance releases of Saxon 11 and Saxon 12 to
44+
close this gap. We urge anyone running untrusted stylesheets or queries under
45+
Saxon-PE or Saxon-EE to move to version 11.7 or 12.8 immediately.</p>
46+
47+
<p>This bug is present in the Java, C#, C, C++, Python and PHP products. It is
48+
not present in Saxon 10 (including the Saxon.NET 10) or in earlier releases. It
49+
is not present in SaxonJS.</p>
50+
51+
</body>
52+
</html>
53+

‎src/announcements/2025/07/saxon-11.7.html‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<html xmlns="http://www.w3.org/1999/xhtml">
3+
<head>
4+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5+
<title>Announcing Saxon 11.7</title>
6+
<meta name="author" content="Norm Tovey-Walsh" />
7+
<meta name="pubdate" content="2025-07-03T17:30:00" />
8+
</head>
9+
<body>
10+
<h1>Announcing Saxon 11.7!</h1>
11+
12+
<p>The Saxon 11.7 maintenance release has been published.
13+
This is a
14+
maintenance release for Java, C#, C/C++, PHP, and Python that
15+
<a href="saxon-11.7-and-12.8.html">fixes a security gap</a> and a number of
16+
other issues that have been addressed since 11.6 was released.</p>
17+
18+
<p>Saxon 11.7 was released on 3 July 2023. This release has been
19+
uploaded to the usual locations on the Saxonica website, GitHub,
20+
Maven, and NuGet. SaxonCS 11.7 is built with .NET 8.</p>
21+
22+
<p>For a list of the issues resolved in this release, please visit the
23+
<a href="https://saxonica.plan.io/projects/saxon/issues?utf8=%E2%9C%93&amp;set_filter=1&amp;sort=id%3Adesc&amp;f%5B%5D=status_id&amp;op%5Bstatus_id%5D=%3D&amp;v%5Bstatus_id%5D%5B%5D=3&amp;f%5B%5D=cf_6&amp;op%5Bcf_6%5D=%3D&amp;v%5Bcf_6%5D%5B%5D=102&amp;f%5B%5D=&amp;c%5B%5D=tracker&amp;c%5B%5D=status&amp;c%5B%5D=priority&amp;c%5B%5D=subject&amp;c%5B%5D=assigned_to&amp;c%5B%5D=updated_on&amp;group_by=&amp;t%5B%5D="
24+
>issue tracker</a>
25+
on the Saxon support site.
26+
</p>
27+
28+
<p>Download products:</p>
29+
30+
<ul>
31+
<li>Binaries for PE and EE are available from our
32+
<a href="http://www.saxonica.com/download/download_page.xml">download pages</a>.
33+
</li>
34+
<li>SaxonJ-HE is available on the
35+
<a href="https://central.sonatype.com/artifact/net.sf.saxon/Saxon-HE/11.7">Maven Central
36+
repository</a>.
37+
</li>
38+
<li>SaxonJ-HE, PE, and EE can also be found on our
39+
<a href="https://dev.saxonica.com/maven/">experimental Maven repository</a>.
40+
</li>
41+
<li>SaxonCS is available on
42+
<a href="https://www.nuget.org/packages/SaxonCS">NuGet</a></li>
43+
<li>Saxon-HE is no longer distributed on SourceForge. It is now available from
44+
our open source
45+
<a href="https://github.com/Saxonica/Saxon-HE/">GitHub repository</a>.
46+
The GitHub repository also provides source code for those who need it.
47+
</li>
48+
</ul>
49+
50+
<p>For more details, please consult
51+
<a href="https://www.saxonica.com/documentation11">the documentation</a>.
52+
</p>
53+
54+
<p>If you encounter any issues with Saxon 11.7, please
55+
<a href="https://saxonica.plan.io/projects/saxon/issues">report them</a>
56+
on our issue tracker.</p>
57+
58+
</body>
59+
</html>
60+

‎src/announcements/2025/07/saxon-12.8.html‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<html xmlns="http://www.w3.org/1999/xhtml">
3+
<head>
4+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5+
<title>Announcing Saxon 12.8</title>
6+
<meta name="author" content="Norm Tovey-Walsh" />
7+
<meta name="pubdate" content="2025-07-03T17:35:00" />
8+
</head>
9+
<body>
10+
<h1>Announcing Saxon 12.8!</h1>
11+
12+
<p>The Saxon 12.8 maintenance release has been published.
13+
This is a
14+
maintenance release for Java, C#, C/C++, PHP, and Python that
15+
<a href="saxon-11.7-and-12.8.html">fixes a security gap</a> and a few
16+
other issues that have been addressed since 12.7 was released.</p>
17+
18+
<p>Saxon 12.8 was released on 3 July 2025. This release has been uploaded to the
19+
usual locations on the Saxonica website, GitHub, and Maven, PyPi, and NuGet.
20+
SaxonCS 12.8 is built with .NET 8.</p>
21+
22+
<p>For a list of the issues resolved in this release, please visit the issue trackers
23+
for
24+
<a href="https://saxonica.plan.io/projects/saxon/issues?utf8=%E2%9C%93&amp;set_filter=1&amp;sort=id%3Adesc&amp;f%5B%5D=status_id&amp;op%5Bstatus_id%5D=%3D&amp;v%5Bstatus_id%5D%5B%5D=3&amp;f%5B%5D=cf_6&amp;op%5Bcf_6%5D=%3D&amp;v%5Bcf_6%5D%5B%5D=103&amp;f%5B%5D=&amp;c%5B%5D=tracker&amp;c%5B%5D=status&amp;c%5B%5D=priority&amp;c%5B%5D=subject&amp;c%5B%5D=assigned_to&amp;c%5B%5D=updated_on&amp;group_by=&amp;t%5B%5D=">SaxonJ and SaxonCS</a> or
25+
<a href="https://saxonica.plan.io/projects/saxon-c/issues?utf8=%E2%9C%93&amp;set_filter=1&amp;sort=id%3Adesc&amp;f%5B%5D=status_id&amp;op%5Bstatus_id%5D=%3D&amp;v%5Bstatus_id%5D%5B%5D=3&amp;f%5B%5D=cf_6&amp;op%5Bcf_6%5D=%3D&amp;v%5Bcf_6%5D%5B%5D=104&amp;f%5B%5D=&amp;c%5B%5D=tracker&amp;c%5B%5D=status&amp;c%5B%5D=priority&amp;c%5B%5D=subject&amp;c%5B%5D=assigned_to&amp;c%5B%5D=updated_on&amp;group_by=&amp;t%5B%5D=">SaxonC</a>
26+
on the Saxon support site.
27+
</p>
28+
29+
<p>Download products:</p>
30+
31+
<ul>
32+
<li>Binaries for PE and EE are available from our
33+
<a href="http://www.saxonica.com/download/download_page.xml">download pages</a>.
34+
</li>
35+
<li>SaxonJ-HE is available on the
36+
<a href="https://central.sonatype.com/artifact/net.sf.saxon/Saxon-HE/12.8">Maven Central
37+
repository</a>.
38+
</li>
39+
<li>SaxonJ-HE, PE, and EE can also be found on our
40+
<a href="https://dev.saxonica.com/maven/">experimental Maven repository</a>.
41+
</li>
42+
<li>Python wheels for SaxonC (HE, PE, and EE) are available from
43+
<a href="https://pypi.org/user/saxonica/">PyPI</a>.
44+
</li>
45+
<li>SaxonCS is available on
46+
<a href="https://www.nuget.org/packages/SaxonCS">NuGet</a></li>
47+
<li>Saxon-HE is available from our open source
48+
<a href="https://github.com/Saxonica/Saxon-HE/">GitHub repository</a>.
49+
The GitHub repository also provides source code for those who need it.
50+
</li>
51+
</ul>
52+
53+
<p>For more details, please consult
54+
<a href="https://www.saxonica.com/documentation12">the documentation</a>.
55+
</p>
56+
57+
<h2>Issues resolved</h2>
58+
59+
<p>In addition to the security issue, only a few other issues have been fixed;
60+
our focus was on getting the security release out promptly.</p>
61+
62+
<h3>Issues in SaxonJ</h3>
63+
64+
<p>Only one additional issue was fixed in SaxonJ:</p>
65+
66+
<ul>
67+
<li><a href="https://saxonica.plan.io/issues/6804">6804</a>
68+
String index out-of-bounds in <code>parse-xml()</code></li>
69+
</ul>
70+
71+
<h3>Issues in SaxonC</h3>
72+
73+
<p>A few small issues were fixed in SaxonC:</p>
74+
75+
<ul>
76+
<li><a href="https://saxonica.plan.io/issues/6835">6835</a>
77+
SaxonC PHP @@VERSION@@</li>
78+
<li><a href="https://saxonica.plan.io/issues/6830">6830</a>
79+
SaxonC HE 12.7.0 - PHP - XdmNode->getColumnNumber() returns the line number</li>
80+
<li><a href="https://saxonica.plan.io/issues/6823">6823</a>
81+
DocumentBuilder memory not deleted</li>
82+
<li><a href="https://saxonica.plan.io/issues/6803">6803</a>
83+
Please provide parseJsonFromString example</li>
84+
<li><a href="https://saxonica.plan.io/issues/6802">6802</a>
85+
Remove XdmAtomicValue::getStringValue</li>
86+
<li><a href="https://saxonica.plan.io/issues/6801">6801</a>
87+
PRIMITIVE_TYPE defined, but not used?</li>
88+
<li><a href="https://saxonica.plan.io/issues/6800">6800</a>
89+
Implement operator== for XdmItem or make it private</li>
90+
<li><a href="https://saxonica.plan.io/issues/6785">6785</a>
91+
Instructions in Python README for running pytest are missing the use of a pytest.ini</li>
92+
</ul>
93+
94+
<p>If you encounter any issues with Saxon 12.8, please
95+
<a href="https://saxonica.plan.io/projects/saxon/issues">report them</a>
96+
on our issue tracker.</p>
97+
98+
</body>
99+
</html>
100+

0 commit comments

Comments
 (0)