/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.commons.xml.secure;

import java.io.IOException;
import java.lang.invoke.MethodHandle;
import java.util.Objects;
import java.util.function.Supplier;

import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.FactoryConfigurationError;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.transform.ErrorListener;
import javax.xml.transform.Source;
import javax.xml.transform.Templates;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerConfigurationException;
import javax.xml.transform.TransformerException;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.TransformerFactoryConfigurationError;
import javax.xml.transform.URIResolver;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.sax.SAXSource;
import javax.xml.transform.sax.SAXTransformerFactory;
import javax.xml.transform.sax.TemplatesHandler;
import javax.xml.transform.sax.TransformerHandler;
import javax.xml.transform.stream.StreamSource;

import org.w3c.dom.Document;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
import org.xml.sax.XMLFilter;
import org.xml.sax.XMLReader;

/**
 * Creates new, secure {@link TransformerFactory} instances.
 * <p>
 * Beyond the three universal guarantees on {@link org.apache.commons.xml.secure}: {@code xsl:import}, {@code xsl:include} and {@code document()} URIs are not
 * resolved.
 * </p>
 * <p>
 * The guarantees govern what the transform reads, not what it writes: an output instruction like {@code xsl:result-document} still writes wherever the
 * stylesheet directs, so an untrusted stylesheet's output destinations must be restricted outside the library.
 * </p>
 * <p>
 * The guarantees apply to every parser the factory creates internally for the standard {@link TransformerFactory} entry points: stylesheet compilation
 * ({@link TransformerFactory#newTemplates(javax.xml.transform.Source) newTemplates(Source)},
 * {@link TransformerFactory#newTransformer(javax.xml.transform.Source) newTransformer(Source)}) and source-document reading at
 * {@code Transformer.transform(Source, Result)} time.
 * </p>
 * <p>
 * The {@code href} an {@code xml-stylesheet} processing instruction names is content of the document being scanned, so
 * {@link TransformerFactory#getAssociatedStylesheet(Source, String, String, String) getAssociatedStylesheet} treats it as any other content-named reference:
 * install a {@link URIResolver} resolving that href to compile the stylesheet it points at. Without one, the returned {@link Source} carries empty content
 * rather than naming the URI, so compiling it cannot fetch a stylesheet the parsed document chose.
 * </p>
 * <p>
 * The {@link javax.xml.transform.sax.SAXTransformerFactory} extension methods ({@code newTransformerHandler(..)}, {@code newTemplatesHandler()},
 * {@code newXMLFilter(..)}), if reachable by casting the returned factory, produce objects carrying the same guarantees.
 * </p>
 * <p>
 * This class is not itself a {@link TransformerFactory}, so it inherits none of the static JAXP factory methods. A caller therefore cannot obtain an unsecured
 * factory through this class by calling a method such as {@code newDefaultInstance()}. The secure factories are instances of a nested, non-public wrapper
 * class.
 * </p>
 *
 * @see org.apache.commons.xml.secure
 */
public final class SecureTransformerFactory {

    /**
     * {@link TransformerFactory} wrapper that rewrites every Source-taking entry point through {@link SecureSAXParserFactory#secure(Source, boolean)} before
     * delegating.
     *
     * <p>
     * Used by providers whose underlying TrAX implementation pulls a new {@code SAXParserFactory.newInstance()} for any Source that is not already a
     * {@link SAXSource} carrying its own {@link XMLReader}, and only sets {@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING FSP} on the resulting reader.
     * Wrapping the factory and rewriting the Source upstream guarantees the parse runs through an {@link org.apache.commons.xml.secure}-secured reader instead.
     * </p>
     * <p>
     * Three layers cooperate:
     * </p>
     * <ol>
     *   <li>{@link SecureTransformerFactory} rewrites the Source on every entry point that compiles a stylesheet or transforms a one-shot input.</li>
     *   <li>{@link SecureTemplates} returns a {@link SecureTransformer} from {@link Templates#newTransformer()} so runtime source parsing is also covered, and
     *       restores the factory's URIResolver onto the produced Transformer (which the underlying implementation typically does not propagate through
     *       {@code Templates}).</li>
     *   <li>{@link SecureTransformer} rewrites the Source on every {@link Transformer#transform(Source, javax.xml.transform.Result)} call.</li>
     * </ol>
     * <p>
     * The {@link SAXTransformerFactory} extension products ride the same wrappers: {@code newTransformerHandler}/{@code newTemplatesHandler} products are
     * wrapped ({@link SecureTransformerHandler}, {@link SecureTemplatesHandler}) so the {@link Transformer}/{@link Templates} they expose carry the resolver
     * floor, and {@code newXMLFilter} returns a {@link SecureXMLFilter} composed from these wrappers instead of the implementation's filter, which would
     * self-provision an unsecured input reader.
     * </p>
     *
     * <h2>Caveats</h2>
     * <ul>
     *   <li>A {@link SAXSource} that carries its own {@link XMLReader} is trusted as-is: the caller is expected to supply a secure reader (via
     * {@link SecureSAXParserFactory#newInstance()}) in that case. The same applies to the SAX events a caller feeds into a handler, and to a parent reader a
     *       caller sets on a returned {@link XMLFilter}. The exception is {@code getAssociatedStylesheet} on an engine that drops the reader (Apache Xalan, and
     * the JDK's XSLTC on Java 8): there the document is pre-parsed into a DOM instead, since the reader would otherwise be replaced by the engine's own.</li>
     * </ul>
     */
    private static final class Wrapper extends SAXTransformerFactory {

        /**
         * Tests whether the delegate is Apache Xalan (either its interpretive or its XSLTC factory), whose {@code getAssociatedStylesheet} ignores a SAXSource
         * reader.
         *
         * @param factory The delegate factory.
         * @return Whether the delegate is an {@code org.apache.xalan.} implementation.
         */
        private static boolean isXalan(final SAXTransformerFactory factory) {
            return factory.getClass().getName().startsWith("org.apache.xalan.");
        }

        /**
         * Whether the delegate recognizes {@value SecureSAXParserFactory#OVERRIDE_DEFAULT_PARSER}, probed with a same-value {@code setFeature}:
         * {@code TransformerFactory.getFeature} cannot signal an unrecognized name (it returns {@code false}), while every implementation rejects a
         * {@code setFeature} for a name it does not support (Xalan with {@link TransformerConfigurationException}, Saxon with its own unchecked exception).
         *
         * @param factory The delegate factory.
         * @return Whether the delegate recognizes the feature.
         */
        private static boolean probeOverrideDefaultParser(final SAXTransformerFactory factory) {
            try {
                factory.setFeature(SecureSAXParserFactory.OVERRIDE_DEFAULT_PARSER,
                        factory.getFeature(SecureSAXParserFactory.OVERRIDE_DEFAULT_PARSER));
                return true;
            } catch (final Exception e) {
                return false;
            }
        }

        /**
         * Returns the value, or reports its absence in the TrAX shape.
         *
         * @param <T>   The type of the product.
         * @param value The value an implementation produced.
         * @param what  Name of the missing product, for the message.
         * @return The value, never {@code null}.
         * @throws TransformerConfigurationException Thrown if {@code value} is {@code null}.
         */
        private static <T> T required(final T value, final String what) throws TransformerConfigurationException {
            // Xalan hands back null instead of throwing when the stylesheet failed to compile: XALANJ-2410.
            if (value == null) {
                throw new TransformerConfigurationException("Underlying implementation returned a null " + what + ".");
            }
            return value;
        }

        private static Templates unwrap(final Templates templates) {
            return templates instanceof SecureTemplates ? ((SecureTemplates) templates).getDelegate() : templates;
        }

        private final SAXTransformerFactory delegate;

        /**
         * Empty-{@link Source} supplier for the resolver floor, threaded onto every produced Templates/Transformer; {@code null} means the default empty DOM.
         */
        private final Supplier<Source> emptySource;

        private final FallbackIgnoreURIResolver floor;

        /**
         * Whether the delegate recognizes {@value SecureSAXParserFactory#OVERRIDE_DEFAULT_PARSER}; its value is read for each created product, as in the JDK.
         */
        private final boolean supportsOverrideDefaultParser;

        /**
         * Constructs a new instance.
         *
         * @param delegate The delegate to wrap; must not be {@code null}.
         * @throws NullPointerException Thrown if {@code delegate} is {@code null}.
         */
        private Wrapper(final SAXTransformerFactory delegate) {
            this(delegate, null);
        }

        /**
         * Constructs a new instance.
         *
         * @param delegate    The delegate to wrap; must not be {@code null}.
         * @param emptySource The empty-{@link Source} supplier for the resolver floor, threaded onto every produced Templates/Transformer; {@code null} means
         * the                    default empty DOM.
         * @throws NullPointerException Thrown if {@code delegate} is {@code null}.
         */
        private Wrapper(final SAXTransformerFactory delegate, final Supplier<Source> emptySource) {
            this.delegate = Objects.requireNonNull(delegate, "delegate");
            this.emptySource = emptySource;
            this.supportsOverrideDefaultParser = probeOverrideDefaultParser(delegate);
            this.floor = new FallbackIgnoreURIResolver(null, emptySource, this::overrideDefaultParser);
            // Compile-time block for xsl:import/xsl:include and document(); a caller-set resolver is routed through the floor rather than replacing it.
            delegate.setURIResolver(floor);
        }

        /**
         * Routes the href an {@code xml-stylesheet} PI yielded through the floor, so a URI distilled from untrusted content is opted in by the caller's
         * resolver or resolved to empty like any other content-named reference.
         *
         * <p>
         * XSLTC-lineage engines resolve the href during the scan, before they install the factory's {@link URIResolver}, and hand back a live
         * {@link SAXSource} naming the absolutized URI; compiling it, the one documented use of this method, would then fetch it. Saxon already floors the href
         * itself and returns an empty source, so flooring here is also what makes the engines agree.
         * </p>
         *
         * @param associated The delegate's result; {@code null} when no PI matched.
         * @param base       The system ID of the scanned document, the base the href was resolved against.
         * @return The caller resolver's source for an opted-in href, an empty source otherwise, or {@code null} when no PI matched.
         * @throws TransformerConfigurationException Thrown if the floor rejects the href, which it does when {@value SecureException#THROW_ON_UNRESOLVED} is
         * set.
         */
        private Source floorAssociated(final Source associated, final String base) throws TransformerConfigurationException {
            if (associated == null || associated.getSystemId() == null) {
                // No PI matched, or the engine already floored the href to a source that names no URI.
                return associated;
            }
            try {
                return floor.resolve(associated.getSystemId(), base);
            } catch (final TransformerException e) {
                throw new TransformerConfigurationException("Failed to resolve the associated stylesheet " + associated.getSystemId(), e);
            }
        }

        /**
         * {@inheritDoc}
         *
         * @throws FactoryConfigurationError Thrown from a factory in case of a {@link java.util.ServiceConfigurationError service
         *                                   configuration error} or if the implementation is not available or cannot be instantiated.
         */
        @Override
        public Source getAssociatedStylesheet(final Source source, final String media, final String title, final String charset)
                throws TransformerConfigurationException {
            // Xalan's getAssociatedStylesheet drops a SAXSource's reader and self-provisions its own to scan for xml-stylesheet PIs (XALANJ-2849), and the
            // JDK's XSLTC did the same before 8u162; hand those a DOM so no parser but ours ever sees the document.
            final Source secure = isXalan(delegate) || JAVA_8 ? secureSourceToDom(source) : SecureSAXParserFactory.secure(source, overrideDefaultParser());
            return floorAssociated(delegate.getAssociatedStylesheet(secure, media, title, charset), secure.getSystemId());
        }

        @Override
        public Object getAttribute(final String name) {
            return delegate.getAttribute(name);
        }

        @Override
        public ErrorListener getErrorListener() {
            return delegate.getErrorListener();
        }

        @Override
        public boolean getFeature(final String name) {
            return delegate.getFeature(name);
        }

        @Override
        public URIResolver getURIResolver() {
            return floor.getDelegate();
        }

        /**
         * {@inheritDoc}
         *
         * @throws FactoryConfigurationError Thrown from a factory in case of a {@link java.util.ServiceConfigurationError service
         *                                   configuration error} or if the implementation is not available or cannot be instantiated.
         */
        @Override
        public Templates newTemplates(final Source source) throws TransformerConfigurationException {
            // newTemplates() should never return null for a specification-compliant factory.
            final Templates templates = delegate.newTemplates(SecureSAXParserFactory.secure(source, overrideDefaultParser()));
            return templates == null ? null : new SecureTemplates(templates, getURIResolver(), emptySource, overrideDefaultParser());
        }

        @Override
        public TemplatesHandler newTemplatesHandler() throws TransformerConfigurationException {
            // newTemplatesHandler() should never return null for a specification-compliant factory.
            final TemplatesHandler handler = delegate.newTemplatesHandler();
            return handler == null ? null : new SecureTemplatesHandler(handler, getURIResolver(), emptySource, overrideDefaultParser());
        }

        @Override
        public Transformer newTransformer() throws TransformerConfigurationException {
            // Identity transformer: still parses runtime sources, so wrap it to secure Transformer.transform(Source, Result).
            // newTransformer() should never return null for a specification-compliant factory.
            final Transformer transformer = delegate.newTransformer();
            return transformer == null ? null : new SecureTransformer(transformer, getURIResolver(), emptySource, overrideDefaultParser());
        }

        /**
         * {@inheritDoc}
         *
         * @throws FactoryConfigurationError Thrown from a factory in case of a {@link java.util.ServiceConfigurationError service
         *                                   configuration error} or if the implementation is not available or cannot be instantiated.
         */
        @Override
        public Transformer newTransformer(final Source source) throws TransformerConfigurationException {
            // newTransformer() should never return null for a specification-compliant factory.
            final Transformer transformer = delegate.newTransformer(SecureSAXParserFactory.secure(source, overrideDefaultParser()));
            return transformer == null ? null : new SecureTransformer(transformer, getURIResolver(), emptySource, overrideDefaultParser());
        }

        @Override
        public TransformerHandler newTransformerHandler() throws TransformerConfigurationException {
            return secure(delegate.newTransformerHandler());
        }

        /**
         * {@inheritDoc}
         *
         * @throws FactoryConfigurationError Thrown from a factory in case of a {@link java.util.ServiceConfigurationError service
         *                                   configuration error} or if the implementation is not available or cannot be instantiated.
         */
        @Override
        public TransformerHandler newTransformerHandler(final Source source) throws TransformerConfigurationException {
            return secure(delegate.newTransformerHandler(SecureSAXParserFactory.secure(source, overrideDefaultParser())));
        }

        /**
         * {@inheritDoc}
         *
         * <p>
         * Most implementations reject a {@link Templates} they did not compile, some in the TrAX shape, others by casting it or its Transformer to their
         * own type. Both reach the caller as a {@link TransformerConfigurationException}.
         * </p>
         */
        @Override
        public TransformerHandler newTransformerHandler(final Templates templates) throws TransformerConfigurationException {
            // Implementations:
            // - cast templates.newTransformer() to their own Transformer type, so hand them the wrapped implementation Templates, not the wrapper;
            // - raise NullPointerException for a null argument, except Saxon; rejecting it here keeps that uniform, as on the other methods.
            final Templates unwrapped = unwrap(Objects.requireNonNull(templates, "templates"));
            try {
                return secure(delegate.newTransformerHandler(unwrapped));
            } catch (final ClassCastException e) {
                throw new TransformerConfigurationException("Failed to create a TransformerHandler from a Templates of type "
                        + unwrapped.getClass().getName(), e);
            }
        }

        /**
         * {@inheritDoc}
         *
         * @throws FactoryConfigurationError Thrown from a factory in case of a {@link java.util.ServiceConfigurationError service
         *                                   configuration error} or if the implementation is not available or cannot be instantiated.
         */
        @Override
        public XMLFilter newXMLFilter(final Source source) throws TransformerConfigurationException {
            return newXMLFilter(required(newTemplates(source), "Templates"));
        }

        @Override
        public XMLFilter newXMLFilter(final Templates templates) throws TransformerConfigurationException {
            final Transformer transformer = required(templates.newTransformer(), "Transformer");
            return new SecureXMLFilter(transformer instanceof SecureTransformer
                    ? (SecureTransformer) transformer
                    : new SecureTransformer(transformer, getURIResolver(), emptySource, overrideDefaultParser()));
        }

        /**
         * Tests whether parsers should be instantiated via {@code newInstance()} instead of {@code newDefaultInstance()}.
         *
         * <p>
         * The JDK implementation of {@link TransformerFactory} uses the JDK parsers while {@value SecureSAXParserFactory#OVERRIDE_DEFAULT_PARSER} is unset
         * or {@code false}.
         * </p>
         *
         * @return {@code true} if parsers should be created via {@code newInstance()}.
         */
        private boolean overrideDefaultParser() {
            return !supportsOverrideDefaultParser || delegate.getFeature(SecureSAXParserFactory.OVERRIDE_DEFAULT_PARSER);
        }

        private TransformerHandler secure(final TransformerHandler handler) {
            return handler == null ? null : new SecureTransformerHandler(handler, getURIResolver(), emptySource, overrideDefaultParser());
        }

        /**
         * Parses a stream or SAX source into a DOM through a secure, namespace-aware {@link javax.xml.parsers.DocumentBuilder} and returns a {@link DOMSource}
         * carrying its system ID, so the consumer walks the tree instead of provisioning its own reader. Any other source is left to
         * {@link SecureSAXParserFactory#secure(Source, boolean)}.
         *
         * <p>
         * A {@link SAXSource} carrying the caller's own reader is pre-parsed here too, unlike everywhere else in this class: an engine that reaches this
         * method drops that reader anyway, so honoring it is not among the options; the choice is only between this parse and the engine's unsecured one.
         * </p>
         *
         * @param source The source to scan for an associated stylesheet.
         * @return A {@link DOMSource} for a stream or SAX source, otherwise the result of {@link SecureSAXParserFactory#secure(Source, boolean)}.
         * @throws TransformerConfigurationException Thrown if the source cannot be parsed.
         * @throws FactoryConfigurationError Thrown from a factory in case of a {@link java.util.ServiceConfigurationError service
         *                                   configuration error} or if the implementation is not available or cannot be instantiated.
         * @throws SecureException Thrown if a (non-Android) factory cannot support the secure processing feature
         * {@link XMLConstants#FEATURE_SECURE_PROCESSING}.
         */
        private Source secureSourceToDom(final Source source) throws TransformerConfigurationException {
            if (source instanceof StreamSource || source instanceof SAXSource) {
                final InputSource inputSource = SAXSource.sourceToInputSource(source);
                if (inputSource != null) {
                    try {
                        final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(overrideDefaultParser());
                        final Document document = factory.newDocumentBuilder().parse(inputSource);
                        return new DOMSource(document, inputSource.getSystemId());
                    } catch (final ParserConfigurationException | SAXException | IOException e) {
                        throw new TransformerConfigurationException("Failed to parse the source for associated-stylesheet lookup", e);
                    }
                }
            }
            return SecureSAXParserFactory.secure(source, overrideDefaultParser());
        }

        @Override
        public void setAttribute(final String name, final Object value) {
            delegate.setAttribute(name, value);
        }

        @Override
        public void setErrorListener(final ErrorListener listener) {
            delegate.setErrorListener(listener);
        }


        @Override
        public void setFeature(final String name, final boolean value) throws TransformerConfigurationException {
            delegate.setFeature(name, value);
        }

        @Override
        public void setURIResolver(final URIResolver resolver) {
            floor.setDelegate(resolver);
        }
    }

    /**
     * Class name of the JDK's built-in default implementation, the Java 8 fallback for {@link #newDefaultInstance()}.
     */
    private static final String JDK_TRANSFORMER_FACTORY = "com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl";

    private static final MethodHandle MH_newDefaultInstance = MethodHandleFactory.findStatic(TransformerFactory.class, "newDefaultInstance");

    /**
     * {@code true} on Java 8, detected by the absence of {@code TransformerFactory.newDefaultInstance()}, which arrived in Java 9.
     * <p>
     * The JDK's XSLTC only began honoring the {@link XMLReader} carried by a {@link SAXSource} in {@code getAssociatedStylesheet} in 8u162; through 8u152 it
     * provisions its own parser, exactly as Apache Xalan does. Java 8 as a whole is used as the boundary rather than the patch level: the two are
     * indistinguishable through any API, and such an old runtime has already chosen correctness of configuration over the cost of a DOM pre-parse.
     * </p>
     */
    private static final boolean JAVA_8 = MH_newDefaultInstance == null;

    /**
     * Returns a new, secure {@link TransformerFactory} of the system-default implementation.
     * <p>
     * Obtained from {@code TransformerFactory.newDefaultInstance()} where the platform provides it (Java 9 or later), and by instantiating the JDK's built-in
     * implementation directly on Java 8.
     * </p>
     *
     * @return A secure factory.
     * @throws IllegalStateException                Thrown if a required secure setting cannot be applied to the underlying implementation.
     * @throws TransformerFactoryConfigurationError Thrown if the running platform provides neither {@code newDefaultInstance()} nor the JDK's built-in
     *                                                implementation (for example, Android).
     */
    public static TransformerFactory newDefaultInstance() {
        if (MH_newDefaultInstance != null) {
            return secure(MethodHandleFactory.invokeExact(() -> (TransformerFactory) MH_newDefaultInstance.invokeExact(), TransformerFactoryConfigurationError.class));
        }
        // Java 8: the method does not exist; instantiate the JDK's built-in default by its class name instead. Where that class does not exist either (for
        // example Android), the lookup miss surfaces as TransformerFactoryConfigurationError, like any newInstance miss.
        return newInstance(JDK_TRANSFORMER_FACTORY, null);
    }

    /**
     * Returns a new, secure {@link TransformerFactory}.
     *
     * @return A secure factory.
     * @throws IllegalStateException Thrown if a required secure setting cannot be applied to the underlying implementation.
     */
    public static TransformerFactory newInstance() {
        return secure(TransformerFactory.newInstance());
    }

    /**
     * Returns a new, secure {@link TransformerFactory} of the given implementation class.
     *
     * @param factoryClassName The fully qualified class name of the {@link TransformerFactory} implementation.
     * @param classLoader      The class loader used to load the factory class; {@code null} means the current thread's context class loader.
     * @return A secure factory.
     * @throws IllegalStateException                Thrown if a required secure setting cannot be applied to the underlying implementation.
     * @throws TransformerFactoryConfigurationError Thrown if {@code factoryClassName} is {@code null} or the factory class cannot be loaded or instantiated.
     */
    public static TransformerFactory newInstance(final String factoryClassName, final ClassLoader classLoader) {
        return secure(TransformerFactory.newInstance(factoryClassName, classLoader));
    }

    /**
     * Applies capability-driven secure settings to any {@link TransformerFactory} on the classpath.
     *
     * <p>
     * Rather than branching on the implementation class, this method probes what the factory supports and adapts:
     * </p>
     * <ul>
     * <li><strong>Saxon</strong> ({@code net.sf.saxon}): recognized by package prefix and handed to {@link SaxonProvider#configure(TransformerFactory)} for the
     *         channels the standard JAXP knobs cannot close (reflection-based extension functions, the collection finder, the internal SAX parser). It is then
     *         wrapped like every other implementation to install the {@link FallbackIgnoreURIResolver} floor; the only
     *         difference is the empty-{@link Source} shape the floor returns, {@code EmptySource} for Saxon rather than the default empty DOM document.</li>
     * <li><strong>FSP</strong> ({@link XMLConstants#FEATURE_SECURE_PROCESSING}): required. On XSLTC it enables the runtime evaluator limits; on Xalan it
     * disables         reflection-based extension functions.</li>
     *     <li><strong>{@link FallbackIgnoreURIResolver} floor</strong>: required. An ignore-all {@link URIResolver} floor, installed by
     *         the nested wrapper and carried onto every produced {@link Transformer}, resolves {@code xsl:import}/{@code xsl:include} at compile
     * time and {@code document()} at runtime to an empty document, the one channel both XSLTC and Xalan route through. A caller-set {@link URIResolver} is
     *         routed through the floor rather than replacing it, so a caller can opt a specific URI in but cannot reopen the fetch.</li>
     *     <li><strong>The nested wrapper</strong>: required. Both implementations fall back to {@code SAXParserFactory.newInstance()} to parse a
     * stylesheet or source document that does not carry its own reader, and only set FSP on it; wrapping the factory rewrites every {@link Source} through an
     *         {@link org.apache.commons.xml.secure}-secured reader instead.</li>
     * </ul>
     *
     * @param factory The factory to secure; never {@code null}.
     * @return a secure factory.
     */
    static TransformerFactory secure(final TransformerFactory factory) {
        // Required: enables secure processing (XSLTC runtime limits; Xalan's extension-function block).
        setFeature(factory, XMLConstants.FEATURE_SECURE_PROCESSING, true);
        if (SaxonProvider.isSaxon(factory.getClass())) {
            // Saxon keeps its vendor Configuration for the channels JAXP cannot close,
            // then goes through the same wrapper as every other implementation for the URIResolver floor;
            // EmptySource is the empty-source shape Saxon's consumers expect.
            return new Wrapper((SAXTransformerFactory) SaxonProvider.configure(factory), SaxonProvider.emptySourceSupplier());
        }
        // Required: source/stylesheet parsing provisions its own SAX reader otherwise; the wrapper routes every Source through a secure one and installs the
        // ignore-all URIResolver floor (blocking xsl:import/include at compile time and document() at runtime) that a caller-set resolver cannot remove.
        return new Wrapper((SAXTransformerFactory) factory);
    }

    private static void setFeature(final TransformerFactory factory, final String feature, final boolean value) {
        try {
            factory.setFeature(feature, value);
        } catch (final Exception e) {
            throw SecureException.featureFailed(feature, factory, e);
        }
    }

    private SecureTransformerFactory() {
        // static only
    }
}