dom4j is an Open Source XML framework for Java. dom4j allows you to read,
write, navigate, create and modify XML documents. dom4j integrates with
DOM and SAX and is seamlessly integrated with full XPath support.
Provides
Requires
License
Plexus
Changelog
* Fri Apr 24 2026 fstrba@suse.com
- Upgrade to upstream version 2.1.5
* Changes:
+ Bump gradle from 6.3 to 8.13 (fixes #187)
+ Remove unnecessary constant conditional
+ Remove misleading no-op lines incorrectly trying to disable
external entities
* Wed Feb 21 2024 gus.kenion@suse.com
- Use %patch -P N instead of deprecated %patchN.
* Thu Feb 15 2024 fstrba@suse.com
- The license is actually Plexus
* Thu Nov 02 2023 shvetz.anton@gmail.com
- JPMS: Add the Automatic-Module-Name attribute to the manifest.
* Thu Aug 24 2023 fstrba@suse.com
- Make a separate flavour for a minimal dom4j-bootstrap package
used to build jaxen and full dom4j
- Added patch:
* 0001-no-jaxen-dom4.patch
* for the bootstrap package, patch out the code that requires
jaxen with dom4j support to build
* Thu Aug 24 2023 fstrba@suse.com
- Upgrade to upstream version 2.1.4
* Improvements and potentially breaking changes
+ Added new factory method
org.dom4j.io.SAXReader.createDefault(). It has more secure
defaults than new SAXReader(), which uses system
XMLReaderFactory.createXMLReader() or
SAXParserFactory.newInstance().newSAXParser().
+ If you use some optional dependency of dom4j (for example
Jaxen, xsdlib etc.), you need to specify an explicit
dependency on it in your project. They are no longer marked as
a mandatory transitive dependency by dom4j.
+ Following SAX parser features are disabled by default in
DocumentHelper.parse() for security reasons (they were enabled
in previous versions):
° http://xml.org/sax/properties/external-general-entities
° http://xml.org/sax/properties/external-parameter-entities
* Other changes:
+ updated pull-parser version
+ Reuse the writeAttribute method in writeAttributes
+ support build on OS with non-UTF8 as default charset
+ Gradle: add an automatic module name
+ Use Correct License Name "Plexus"
+ Possible vulnerability of DocumentHelper.parseText() to XML
injection
+ CVS directories left in the source tree
+ XMLWriter does not escape supplementary unicode characters
correctly
+ writer.writeOpen(x) doesn't write namespaces
+ concurrency problem with QNameCache
+ all dependencies are optional
+ SAXReader: hardcoded namespace features
+ validate QNames
+ StringIndexOutOfBoundsException in
XMLWriter.writeElementContent()
+ TreeNode has grown some generics
+ QName serialization fix
+ DocumentException initialize with nested exception
+ Accidentally occurring error in a multi-threaded test
+ compatibility with W3C DOM Level 3
+ use Java generics
- Removed patches:
* dom4j-1.6.1-bug1618750.patch
* dom4j-CVE-2018-1000632.patch
* dom4j-CVE-2020-10683.patch
* dom4j-enable-stax-datatypes.patch
* dom4j-javadoc.patch
* dom4j-sourcetarget.patch
+ not needed with this version
* Mon Jul 24 2023 fstrba@suse.com
- Do not depend on jtidy, since it is not used during build
* Wed Mar 30 2022 fstrba@suse.com
- Build against the standalone JavaEE modules unconditionally
* Mon Mar 28 2022 fstrba@suse.com
- Add alias to the new artifact coordinates org.dom4j:dom4j
- Simplify the spec file a bit
* Thu Mar 17 2022 fstrba@suse.com
- Add jaxb-api dependency for relevant distribution versions so that
we can build with JDKs that do not include the JavaEE modules
* Fri Apr 17 2020 pmonrealgonzalez@suse.com
- Security fix: [bsc#1169760, CVE-2020-10683]
* External Entity vulnerability in default SAX parser
* Add dom4j-CVE-2020-10683.patch
* Fri Jan 25 2019 cbosdonnat@suse.com
- Build STAXEventReader, STAXEventWriter and the data types.
[bsc#1123158]
* Added patch dom4j-enable-stax-datatypes.patch
* Tue Sep 18 2018 pmonrealgonzalez@suse.com
- Security fix: [bsc#1105443, CVE-2018-1000632]
* Version prior to version 2.1.1 contains a CWE-91: XML
Injectionvulnerability in Class: Element. Methods: addElement,
addAttribute that canresult in an attacker tampering with XML
documents through.
* Added dom4j-CVE-2018-1000632.patch
* Tue Jul 10 2018 fstrba@suse.com
- Added patch:
* dom4j-javadoc.patch
+ Don't load urls while building javadoc in environment without
connectivity
* Wed May 16 2018 fstrba@suse.com
- Modified patch:
* dom4j-sourcetarget.patch
+ Build with source and target 8 to prepare for a possible
removal of 1.6 compatibility
* Fri Sep 08 2017 fstrba