Repository navigation
feat: industrial schema validation and adversarial payload hardening (#10) - #14
Merged
Merged
Conversation
github-actions Bot
pushed a commit
that referenced
this pull request
Oct 12, 2026
# [1.1.0](v1.0.2...v1.1.0) (2026-10-12) ### Bug Fixes * **ci:** make differential fuzz runner stdout ascii-safe for Windows console ([7a9e41f](7a9e41f)) * **ci:** make Rust extension import optional in common/init and build in rust-check job ([cf9553c](cf9553c)) * **test:** bundle industrial XML instance payloads for cross-platform CI runner parity ([707808f](707808f)) ### Features * **ci,docs:** add banner, CI for Python 3.14/3.15, OSV metadata, and decouple compatibility tests ([89f508d](89f508d)) * **dropin:** add minidom and sax drop-in modules, XML 1.0 attribute normalization, hypothesis testing, and libFuzzer target ([46689bf](46689bf)) * industrial schema validation and adversarial payload hardening ([#10](#10)) ([#14](#14)) ([7ef8f7a](7ef8f7a)) * **security:** add max_input_size and max_elements defenses, modularize PyO3 feature, and clean issue references ([023a650](023a650)) * **security:** harden XML parser against audit findings A1-A12 and fix stdlib parity ([#7](#7)) ([7d68839](7d68839)) * **test:** add automated differential fuzzing against stdlib and defusedxml ([#8](#8)) ([#12](#12)) ([ed7c40a](ed7c40a)) * W3C XML conformance manifest runner and parser compliance ([#9](#9)) ([#13](#13)) ([47cea2a](47cea2a))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #10.
Overview
Validates SafeXML against a diverse corpus of real-world industrial XML schemas and instance documents, and hardens against adversarial payload injection into enterprise protocols (SAML 2.0 and AS4 ebMS3).
Key Highlights
polyxml-schema-corpusacross domains:saml-schema-protocol-2.0.xsd,saml-schema-assertion-2.0.xsd)ebms-header-3_0-200704.xsd)fpml-main-5-12.xsd), ISO 20022 (pacs.008.001.10.xsd,camt.054.001.10.xsd)fhir-single.xsd, 2.60 MB)UCI_MessageDefinitions_v2_5_0.xsd, 8.09 MB), FIXM 4.0UBL-CommonAggregateComponents-2.1.xsd, 2.36 MB), railML 2.4, NeTEx, SIRIxml.etree.ElementTree.defusedxmlunder Python thread pools by releasing the GIL in Rust.docs/INDUSTRIAL_VALIDATION.mddetailing methodology, findings, and performance.