[matthijsln]

Summary

Stacked on #2839 (base branch harden-xml-parsers-and-transformers); review only the last two commits.

• Replace Aalto with Woodstox for the BGT and BAG2 loaders. Aalto was added for performance, which is not critical anymore: XML parsing CPU usage is small compared to network and database IO, and loading is multithreaded. brmo-service already excluded Aalto and so already ran these loaders on Woodstox. woodstox-core is now managed at 7.3.0, which also upgrades the 6.x version pulled in transitively (CXF, xmlsec).
• New StaxMateFactories (bgt-loader, also used by bag2-loader): creates the StaxMate input factory secured by Apache Commons Secure XML (coalescing, no DTD), and fails with an IllegalStateException if the StAX implementation does not natively implement Stax2.

Why the Stax2 check

StaxMate works with any StAX parser, but for a non-Stax2 parser (such as the JDK default) it wraps the reader in Stax2ReaderAdapter, which counts the element depth itself in next() and getElementText() but not in nextTag().

The GeoTools XmlStreamGeometryReader reads geometries directly from SMInputCursor.getStreamReader() and uses nextTag(). StaxMate re-synchronizes cursors using getDepth() of the reader, so after a curved geometry (gml:Arc) the depth is off and the cursors silently skip all following attributes of the object. Polygons happen to balance out, so only the bgt_wijk_curve.gml test caught it when Aalto was removed.

StaxMate allows but discourages bypassing cursors (see FasterXML/StaxMate#2, still open). With a native Stax2 parser the depth is tracked by the parser itself, so this works. The javadoc of StaxMateFactories documents this, and that the check should stay even when StaxMate is upgraded automatically, unless that issue is verified to be resolved.

Test plan

• BGTObjectStreamerTest (including bgt_wijk_curve.gml) and BAG2 loader tests pass with Woodstox
• New StaxMateFactoriesTest: native Stax2 reader with Woodstox; IllegalStateException when the JDK StAX implementation is selected
• Each commit builds and passes the unit tests on its own; brmo-service, nhr-loader and brmo-commandline (CXF with Woodstox 7.3.0) pass
• Integration tests (database profiles) loading BGT and BAG2 data

🤖 Generated with Claude Code

[matthijsln]

Aalto was only used in standalone docker images for the bag2 and bgt loaders, Woodstox was already used in brmo-service.

The JDK-default Stax1 parser was never used in deployments so no attributes were ever dropped, this is just an added precaution.

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 37%. Comparing base (a736883) to head (624cbec).

Files with missing lines	Patch %	Lines
.../main/java/nl/b3p/brmo/util/StaxMateFactories.java	84%	2 Missing ⚠️

Additional details and impacted files

@@                          Coverage Diff                          @@
##             harden-xml-parsers-and-transformers   #2840   +/-   ##
=====================================================================
+ Coverage                                     37%     37%   +1%     
  Complexity                                    74      74           
=====================================================================
  Files                                        200     201    +1     
  Lines                                      13545   13547    +2     
  Branches                                    1431    1432    +1     
=====================================================================
+ Hits                                        4904    4905    +1     
- Misses                                      8233    8235    +2     
+ Partials                                     408     407    -1     

Files with missing lines	Coverage Δ
...3p/brmo/bag2/loader/BAG2GMLMutatieGroepStream.java	86% <100%> (-<1%)	⬇️
...java/nl/b3p/brmo/bgt/loader/BGTObjectStreamer.java	82% <100%> (-<1%)	⬇️
.../main/java/nl/b3p/brmo/util/StaxMateFactories.java	84% <84%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.