Bind XML parsing and schema resolution to one reviewed contract

Give each stage its own resolution contract

An import worker accepts an owned XML note, validates it, and extracts text for an assistant. Restricting the first parser does not establish what happens when a schema compiler reads an import or a later validator receives another input representation.

This guide selects the JDK 25 built-in JAXP DOM and W3C XML Schema 1.0 APIs. The official sources identify Java SE 25; no installed build or provider was inspected. The upload guide supplies the broader ingestion boundary. Here the new decision is which exact parser, schema and resolver instances may introduce resources.

Define a small, useful positive import

Invent document D-17, owned by workspace W-A, containing a note title and body. Schema bundle S-7 consists of a root schema and one type-definition resource. Its immutable manifest binds both resources' identities, approved bytes, namespaces and permitted reference relationship. This is metadata notation, not constructed XML or a compiled schema.

The proposed positive result is the checked title and body, with D-17's source revision. Schema selection comes from trusted application configuration. The document cannot choose another schema. Reject schema-location hints, inclusion elements, unexpected vocabulary and unsupported declarations under this deliberately narrow format.

Example ceilings are sixty-four KiB of document bytes, thirty-two KiB across schema resources, and sixteen KiB of extracted UTF-8 text. They are invented admission limits, not measured safe capacities or complete resource controls.

Configure the document parser before reading bytes

Use DocumentBuilderFactory.newDefaultInstance(), explicitly enable namespace awareness and secure processing, leave DTD validation disabled and its attached Schema unset, and disable XInclude processing. Require the documented http://apache.org/xml/features/disallow-doctype-decl feature to be true. The JDK 25 security guide describes its fatal rejection of DOCTYPE declarations.

Set ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_SCHEMA to empty strings at the applicable factories/processors. XMLConstants defines protocol-list restrictions; permitting file would still permit local-file access. These properties are not a general operating-system sandbox.

Supply the admitted document bytes through DocumentBuilder.parse(InputStream). Do not substitute a document-provided URI. XInclude disabled means no inclusion processing; the application's vocabulary check must separately reject inclusion markup. Turning entity-reference expansion off alone is not the chosen DTD-rejection mechanism.

Compile the approved schema without opening arbitrary locations

Create the built-in SchemaFactory separately, with secure processing and empty external DTD/schema access lists. For its internal parsing, require jdk.xml.dtd.support=deny in the reviewed process JAXP configuration before factory initialization; the security guide documents that setting's rejection behavior. Unsupported configuration holds admission.

The root is an application-supplied StreamSource backed by approved in-memory bytes and an application-owned absolute system ID. A system ID also supplies a base for relative references. A URL-only source is a different input path. External-access restrictions do not authenticate the explicitly supplied root or undo I/O the caller already performed.

Bind compilation's resolver to S-7. A request must match the approved resource type, namespace, system ID and base-ID relationship before receiving the mapped resource's owned content. Do not turn an arbitrary reference into a filesystem path, URL fetch or catalog fallback. Preserve the complete bundle revision when admitting the resulting Schema.

Treat resolver results and validation as separate authority

The LSResourceResolver contract allows null to request normal URI resolution. For this profile, unknown references abort; they do not return null. SchemaFactory documents that a resolver-thrown runtime exception aborts compilation. The security guide also explains that external-access properties do not constrain a non-null source supplied by a resolver. The resolver's own content selection therefore needs review.

A factory's resolver and error handler are not inherited by its validators. Create a fresh Validator from admitted S-7 and configure its external-access properties, resolver and error handler explicitly. Its resolver rejects every reference outside the same approved mapping. Errors and fatal errors abort the job; a handler that continues can allow validation to return normally despite errors.

Validate the already-checked document as a DOMSource, preserving its controlled identity and preventing replacement. Passing raw StreamSource input later introduces internal parsing and requires a new stage review. No transformation, stylesheet, XInclude pass or third-party parser is part of this contract.

Review an original stage and release matrix

Keep the evidence narrower than the configuration

Record runtime/build/provider, configuration revision, schema-bundle revision, resolver decisions and terminal status without logging document contents. Review supported depth, entity and schema-processing limits separately from worker memory/time and output ceilings. A byte cap or secure-processing setting does not establish universal pre-allocation or whole-job protection.

All eight cases are PROPOSED_UNRUN. No XML was constructed, and no parser/runtime inspection, import, execution, schema compilation, resolution, file/network experiment, installation, API or model call was performed for them. Source research establishes documentation support, not effective runtime behavior. Boundary is a prelaunch commercial model router; it supplies no shipped XML parser or validation sandbox. Its eight mock policy checks are different evidence.