Recognize classes used in web.xml as main classes by slawekjaranowski · Pull Request #264 · apache/maven-dependency-analyzer

slawekjaranowski · 2026-01-18T09:51:44Z

A web application may include classes provided by dependency artifacts. Class references defined in web.xml are now recognized as main used classes.

Following this checklist to help us incorporate your
contribution quickly and easily:

Your pull request should address just one issue, without pulling in other changes.
Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
Each commit in the pull request should have a meaningful subject line and body.
Note that commits might be squashed by a maintainer on merge.
Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied.
This may not always be possible but is a best-practice.
Run mvn verify to make sure basic checks pass.
A more thorough check will be performed on your pull request automatically.
You have run the integration tests successfully (mvn -Prun-its verify).

If your pull request is about ~20 lines of code you don't need to sign an
Individual Contributor License Agreement if you are unsure
please ask on the developers list.

To make clear that you license your contribution under
the Apache License Version 2.0, January 2004
you have to acknowledge this by using the following check-box.

I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004
In any other case, please file an Apache Individual Contributor License Agreement.

A web application may include classes provided by dependency artifacts. Class references defined in web.xml are now recognized as main used classes.

elharo · 2026-01-19T12:02:40Z

...che/maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProvider.java

+            throws IOException, SAXException, XPathExpressionException, ParserConfigurationException {
+
+        DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);


I think you need to set the namespace feature to true here

when I set:

documentBuilderFactory.setNamespaceAware(true);

xpath stops working .... we can have web.xml in both namespace ... javaee - old and jakartaee

it will be more complicated to build xpath

If the the xpath stops working, then the xpath is wrong. You likely have two errors that are cancelling each other out, but that's very brittle.

web.xml in both namespaces is a problem, and that's a big reason not to change namespaces with new versions. It causes exactly this sort of problem.

You can match on the local-name() instead or rearrange the code to use separate paths for the two different namespaces.

done use namespace with local-name

...che/maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProvider.java

elharo · 2026-01-20T13:28:27Z

...che/maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProvider.java

+            throws IOException, SAXException, XPathExpressionException, ParserConfigurationException {
+
+        DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+        documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);


If the the xpath stops working, then the xpath is wrong. You likely have two errors that are cancelling each other out, but that's very brittle.

web.xml in both namespaces is a problem, and that's a big reason not to change namespaces with new versions. It causes exactly this sort of problem.

You can match on the local-name() instead or rearrange the code to use separate paths for the two different namespaces.

elharo · 2026-01-20T20:56:25Z

...che/maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProvider.java

+    private XPathExpression[] getXPathExpression() throws XPathExpressionException {
+        XPathFactory xPathFactory = XPathFactory.newInstance();
+        XPath xpath = xPathFactory.newXPath();
+        return new XPathExpression[] {


Just noticed you have multiple XPath expressions here already, so you probably should just double them up, one for each namespace. You will need to provide a NamespaceContext object that binds the prefixes you use here to the actual namespace URIs.

When I use local-name I don't need a NamespaceContext.

I don't want to complicate it so much.
Goal is to take some values from web.xml not verifying it.

In case of wrong namespaces, missing namespaces in web.xml I don't want to break a build it and so ...

I did as you propose:

You can match on the local-name() instead or rearrange the code to use separate paths for the two different namespaces.

@elharo any other remarks?

@elharo kindly reminder

I still think this should break in the case of a missing namespace. I suggested local-name only because I didn't yet notice that you were already using a list.

Ok, once again one achievement here is to read some values from web.xml, it should be easy and quick task.

Validation wrong syntax, missing namespace and so on is not a goal for this taks - here we have dependency analizes.

What benefit we will have for strict validating namespace here?

Copilot

Pull request overview

This pull request adds support for recognizing classes referenced in web.xml as main used classes for WAR projects. This enables proper dependency analysis for web applications where classes from dependency artifacts are referenced in deployment descriptors but may not be directly referenced in compiled code.

Changes:

Implements a new WarMainDependencyClassesProvider that parses web.xml files to extract class references from filter-class, listener-class, and servlet-class elements
Adds comprehensive unit tests including edge cases (malformed XML, missing files, namespace variations)
Includes integration tests demonstrating the feature working with Maven projects
Changes plexus-xml dependency scope from test to provided since Xpp3Dom is used in the main code

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/main/java/org/apache/maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProvider.java	New provider implementation that parses web.xml files to extract class references for WAR projects
src/test/java/org/apache/maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProviderTest.java	Unit tests covering various web.xml scenarios including standard location, custom location, and edge cases
src/test/resources/webapp/src/main/webapp/WEB-INF/web.xml	Test resource with standard web.xml containing filter, listener, and servlet class references
src/test/resources/webapp/examples/*.xml	Additional test resources for edge cases (empty, malformed, no namespace, multiple entries)
src/it/web-application/pom.xml	Integration test parent POM declaring dependencies to test against
src/it/web-application/web1/pom.xml	Integration test module using standard web.xml location
src/it/web-application/web2/pom.xml	Integration test module using custom web.xml location via maven-war-plugin configuration
src/it/web-application/web1/src/main/webapp/WEB-INF/web.xml	Integration test web.xml at standard location
src/it/web-application/web2/webapp/WEB-INF/web.xml	Integration test web.xml at custom location
src/it/web-application/verify.groovy	Integration test verification script checking that classes from web.xml are properly detected
pom.xml	Moves plexus-xml dependency from test to provided scope as it's now used in main code

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

...che/maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProvider.java

...maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProviderTest.java

src/it/web-application/pom.xml

src/it/web-application/web1/pom.xml

src/it/web-application/web2/pom.xml

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

...che/maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProvider.java

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

slawekjaranowski · 2026-01-27T19:45:57Z

@elharo I have changed an implementation, I simply use getElementsByTagName without XPath

So I hope we can finish discusion on this PR.

elharo · 2026-01-27T20:22:02Z

...che/maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProvider.java

+    }
+
+    private void processClassesFromTags(Document doc, List<String> classes, String tagName) {
+        NodeList tags = doc.getElementsByTagName(tagName);


The problem with getElementsByTagName is that it only works with the exact tag name with the exact prefix (or lack thereof) specified. So now you're not recognizing a lot of tags you want to recognize.

With DOM or XPath or anything else, you need to work with namespaces as designed. That means search by local name and namespace URI. Trying to avoid that is brittle at best and likely will break sooner or later.

Can you provide an example web.xml which brake my implementation?

please look again now use getElementsByTagNameNS ....

Copilot

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/test/resources/webapp/examples/nons-web.xml

Recognize classes used in web.xml as main classes

957a278

A web application may include classes provided by dependency artifacts. Class references defined in web.xml are now recognized as main used classes.

slawekjaranowski self-assigned this Jan 18, 2026

slawekjaranowski added the enhancement New feature or request label Jan 18, 2026

slawekjaranowski requested review from Bukama, elharo and slachiewicz January 18, 2026 19:39

elharo requested changes Jan 19, 2026

View reviewed changes

slawekjaranowski requested a review from elharo January 19, 2026 18:17

web.xml with old version

53b0500

elharo requested changes Jan 20, 2026

View reviewed changes

Enable namespace for document factory

7f1387f

slawekjaranowski requested a review from elharo January 20, 2026 20:43

elharo reviewed Jan 20, 2026

View reviewed changes

slawekjaranowski requested a review from elharo January 20, 2026 21:28

Use getElementsByTagName instead of XPath

199ae91

slawekjaranowski requested a review from Copilot January 27, 2026 17:12

Copilot started reviewing on behalf of slawekjaranowski January 27, 2026 17:28 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

Fix after copilot review

54620fb

slawekjaranowski requested a review from Copilot January 27, 2026 18:08

Copilot started reviewing on behalf of slawekjaranowski January 27, 2026 18:19 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

...che/maven/shared/dependency/analyzer/dependencyclasses/WarMainDependencyClassesProvider.java Show resolved Hide resolved

More security settings for document builder factory

b63f4bd

slawekjaranowski requested a review from Copilot January 27, 2026 19:17

Copilot started reviewing on behalf of slawekjaranowski January 27, 2026 19:18 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

elharo requested changes Jan 27, 2026

View reviewed changes

slawekjaranowski added 2 commits January 28, 2026 00:00

Use getElementsByTagNameNS

e38e00a

spotless

25e6ed5

slawekjaranowski requested review from Copilot and elharo January 27, 2026 23:05

Copilot started reviewing on behalf of slawekjaranowski January 27, 2026 23:05 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

src/test/resources/webapp/examples/nons-web.xml Show resolved Hide resolved

elharo approved these changes Jan 28, 2026

View reviewed changes

slawekjaranowski merged commit a1a1f98 into apache:master Jan 28, 2026
17 checks passed

slawekjaranowski deleted the web-classess branch January 28, 2026 20:16

github-actions bot added this to the 1.16.1 milestone Jan 28, 2026

Conversation

slawekjaranowski commented Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

slawekjaranowski commented Jan 27, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

slawekjaranowski commented Jan 18, 2026 •

edited

Loading