Add null check for locator in NonVerifyingHandler.startElement()

[Copilot]

NonVerifyingHandler.startElement() dereferences locator without a null guard, unlike the parent class XOMHandler.startElement() which checks locator != null before calling getSystemId(). If a SAX parser omits the setDocumentLocator() call, this causes an NPE.

• Wrapped the locator.getSystemId() block in a null check, matching the existing pattern in XOMHandler:

if (locator != null) {
     String baseURI = locator.getSystemId();
     if (baseURI != null && !baseURI.equals(documentBaseURI)) {
         element.setActualBaseURI(baseURI);
     }
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• docbook.org
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-21dfcdbaef38c632/dbs/java/working/files-to-index16764399873775334931.list --sourceArchiveDir=/tmp/codeql-scratch-21dfcdbaef38c632/dbs/java/src --outputDir=/tmp/codeql-scratch-21dfcdbaef38c632/dbs/java/trap/java ork/xom/xom/ivy/xercesImpl-2.12.2.jar:/home/REDACTED/work/xom/xom/build/classes:/home/REDACTED/work/commit rgo/bin/git (dns block)
• www.oasis-open.org
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-21dfcdbaef38c632/dbs/java/working/files-to-index16764399873775334931.list --sourceArchiveDir=/tmp/codeql-scratch-21dfcdbaef38c632/dbs/java/src --outputDir=/tmp/codeql-scratch-21dfcdbaef38c632/dbs/java/trap/java ork/xom/xom/ivy/xercesImpl-2.12.2.jar:/home/REDACTED/work/xom/xom/build/classes:/home/REDACTED/work/commit rgo/bin/git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)