(tomee) branch main updated: improve maven metadata and settings parsing

[jungm]

This is an automated email from the ASF dual-hosted git repository.

jungm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git


The following commit(s) were added to refs/heads/main by this push:
     new a454ac2579 improve maven metadata and settings parsing
a454ac2579 is described below

commit a454ac25794674aa41c5375ab4bf33f99d6a2b8e
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sun Aug 23 21:23:16 2026 +0200

    improve maven metadata and settings parsing
---
 .../openejb/loader/provisining/MavenResolver.java   | 19 +++++++++++++++++++
 .../loader/provisining/MavenResolverTest.java       | 21 +++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git 
a/container/openejb-loader/src/main/java/org/apache/openejb/loader/provisining/MavenResolver.java
 
b/container/openejb-loader/src/main/java/org/apache/openejb/loader/provisining/MavenResolver.java
index 55bddf2367..bc7faae78a 100644
--- 
a/container/openejb-loader/src/main/java/org/apache/openejb/loader/provisining/MavenResolver.java
+++ 
b/container/openejb-loader/src/main/java/org/apache/openejb/loader/provisining/MavenResolver.java
@@ -50,6 +50,18 @@ public class MavenResolver implements ArchiveResolver, 
ProvisioningResolverAware
     static {
         FACTORY.setNamespaceAware(false);
         FACTORY.setValidating(false);
+        trySetFeature("http://apache.org/xml/features/disallow-doctype-decl";, 
true);
+        trySetFeature("http://xml.org/sax/features/external-general-entities";, 
false);
+        
trySetFeature("http://xml.org/sax/features/external-parameter-entities";, false);
+        FACTORY.setXIncludeAware(false);
+    }
+
+    private static void trySetFeature(final String feature, final boolean 
value) {
+        try {
+            FACTORY.setFeature(feature, value);
+        } catch (final Exception e) {
+            // no-op: feature not supported by this parser
+        }
     }
 
     private ProvisioningResolver resolver;
@@ -148,6 +160,13 @@ public class MavenResolver implements ArchiveResolver, 
ProvisioningResolverAware
                 DocumentBuilder builder = BUILDER.get();
                 if (null == builder) {
                     final DocumentBuilderFactory factory = 
DocumentBuilderFactory.newInstance();
+                    try {
+                        
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl";, 
true);
+                    } catch (final Exception e) {
+                        // no-op: feature not supported by this parser
+                    }
+                    factory.setXIncludeAware(false);
+                    factory.setExpandEntityReferences(false);
                     builder = factory.newDocumentBuilder();
                     BUILDER.set(builder);
                 }
diff --git 
a/container/openejb-loader/src/test/java/org/apache/openejb/loader/provisining/MavenResolverTest.java
 
b/container/openejb-loader/src/test/java/org/apache/openejb/loader/provisining/MavenResolverTest.java
index 1fa5d5493c..73328dd36b 100644
--- 
a/container/openejb-loader/src/test/java/org/apache/openejb/loader/provisining/MavenResolverTest.java
+++ 
b/container/openejb-loader/src/test/java/org/apache/openejb/loader/provisining/MavenResolverTest.java
@@ -22,9 +22,11 @@ import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 
+import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.InputStream;
+import java.lang.reflect.Method;
 import java.util.Collections;
 import java.util.jar.JarFile;
 
@@ -75,6 +77,25 @@ public class MavenResolverTest {
         
resolveCommon("mvn:https://repo1.maven.org/maven2/!junit:junit:LATEST:jar";);
     }
 
+    @Test
+    public void doctypeInMetadataKeepsRequestedVersion() throws Exception {
+        final File external = File.createTempFile("metadata", ".txt");
+        external.deleteOnExit();
+        try (final FileOutputStream out = new FileOutputStream(external)) {
+            out.write("1.2.3".getBytes("UTF-8"));
+        }
+
+        final String xml = "<?xml version=\"1.0\"?>\n"
+                + "<!DOCTYPE metadata [<!ENTITY ext SYSTEM \"" + 
external.toURI().toURL() + "\">]>\n"
+                + 
"<metadata><versioning><release>&ext;</release><latest>&ext;</latest></versioning></metadata>";
+        final ByteArrayOutputStream metadata = new ByteArrayOutputStream();
+        metadata.write(xml.getBytes("UTF-8"));
+
+        final Method extract = 
MavenResolver.class.getDeclaredMethod("extractRealVersion", String.class, 
ByteArrayOutputStream.class);
+        extract.setAccessible(true);
+        assertEquals("LATEST", extract.invoke(null, "LATEST", metadata));
+    }
+
     @Test
     public void overrideRepo() throws Exception {
         System.setProperty("openejb.deployer.repository", 
"https://bob.smith/repo/";);