Is there any way to avoid that available-environment-variables() returns environment data other than implementing EnvironmentVariableResolver?

Setting https://www.saxonica.com/html/documentation/javadoc/net/sf/saxon/lib/FeatureKeys.html#ALLOW_EXTERNAL_FUNCTIONS as false disables exposure of Java system properties through @system-property@ but it does not seem to prevent exposure of environment variables through @available-environment-variables()@.

Is there any configuration setting to disable exposure of any environment variables through @available-environment-variables()@?

Or do I have to implement @EnvironmentVariableResolver@ and return an empty @Set@ to ensure that environment variables are not exposed?

I agree it would make sense for available-environment-variables() to take account of this configuration option.

(1-1/1)

Please register to reply

Saxon