DOM Node serialization omits the default namespace declaration

[magott]

When serializing xml with a default namespace (eg: <root xmlns='http://foo'/>) the default namespace is omitted when using the DOMImplementationLS for serialization. This seem to be a change that has happened in the JDK around JDK11. By switching the serialization method to using the Transformer api, the default namespace is included in the xml string.

The PR has a test that verifies the issue on Java15.

I didn't have java14 so I had to do some modification to build the project on my machine using Java15, so this has to be verified on your build setup before you consider merging it.

[cowtowncoder]

Sounds reasonable, thank you for contributing this!

Aside from one minor comment I made, one question: can you think of any security issues wrt using default Transformer? With JDK XML functionality there have been a few reports about default setting of expanding external general entities and such -- I don't think those should apply here (since this is not about parsing but generation) but thought I'd ask just in case.

Another thing I'd need (unless already asked) would be CLA: it only needs to be sent once, and can found here:

https://github.com/FasterXML/jackson/blob/master/contributor-agreement.pdf

and is often done by printing the doc, filling & signing, scan/photo, email to info at fasterxml dot com.
Once that is done CLA is good for all contributions (so if you have done it before just let me know and I can verify, no need to send again).

Thank you again!

[magott]

I don't see how those issues with XML Transformer would come to play when generating a string, but I added the secure processing flag to the transformer anyway, just to be sure 😄

CLA signed and e-mailed

[cowtowncoder]

Agreed: thank you for adding that setting: shouldn't hurt and might help for something non-obvious.
I can see the CLA too, thanks!