This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch tomee-10.x in repository https://gitbox.apache.org/repos/asf/tomee.git
commit 1a4c70bbd281b142e745c6f1311061872c6f6e01 Author: Markus Jung <[email protected]> AuthorDate: Sun Aug 23 21:23:16 2026 +0200 improve maven metadata and settings parsing (cherry picked from commit a454ac25794674aa41c5375ab4bf33f99d6a2b8e) --- .../openejb/loader/provisining/MavenResolver.java | 19 +++++++++++++++++++ .../loader/provisining/MavenResolverTest.java | 21 +++++++++++++++++++++ 2 files changed, 40 insertions(+) diff --git a/container/openejb-loader/src/main/java/org/apache/openejb/loader/provisining/MavenResolver.java b/container/openejb-loader/src/main/java/org/apache/openejb/loader/provisining/MavenResolver.java index 55bddf2367..bc7faae78a 100644 --- a/container/openejb-loader/src/main/java/org/apache/openejb/loader/provisining/MavenResolver.java +++ b/container/openejb-loader/src/main/java/org/apache/openejb/loader/provisining/MavenResolver.java @@ -50,6 +50,18 @@ public class MavenResolver implements ArchiveResolver, ProvisioningResolverAware static { FACTORY.setNamespaceAware(false); FACTORY.setValidating(false); + trySetFeature("http://apache.org/xml/features/disallow-doctype-decl";, true); + trySetFeature("http://xml.org/sax/features/external-general-entities";, false); + trySetFeature("http://xml.org/sax/features/external-parameter-entities";, false); + FACTORY.setXIncludeAware(false); + } + + private static void trySetFeature(final String feature, final boolean value) { + try { + FACTORY.setFeature(feature, value); + } catch (final Exception e) { + // no-op: feature not supported by this parser + } } private ProvisioningResolver resolver; @@ -148,6 +160,13 @@ public class MavenResolver implements ArchiveResolver, ProvisioningResolverAware DocumentBuilder builder = BUILDER.get(); if (null == builder) { final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + try { + factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl";, true); + } catch (final Exception e) { + // no-op: feature not supported by this parser + } + factory.setXIncludeAware(false); + factory.setExpandEntityReferences(false); builder = factory.newDocumentBuilder(); BUILDER.set(builder); } diff --git a/container/openejb-loader/src/test/java/org/apache/openejb/loader/provisining/MavenResolverTest.java b/container/openejb-loader/src/test/java/org/apache/openejb/loader/provisining/MavenResolverTest.java index 1fa5d5493c..73328dd36b 100644 --- a/container/openejb-loader/src/test/java/org/apache/openejb/loader/provisining/MavenResolverTest.java +++ b/container/openejb-loader/src/test/java/org/apache/openejb/loader/provisining/MavenResolverTest.java @@ -22,9 +22,11 @@ import org.junit.Assert; import org.junit.Before; import org.junit.Test; +import java.io.ByteArrayOutputStream; import java.io.File; import java.io.FileOutputStream; import java.io.InputStream; +import java.lang.reflect.Method; import java.util.Collections; import java.util.jar.JarFile; @@ -75,6 +77,25 @@ public class MavenResolverTest { resolveCommon("mvn:https://repo1.maven.org/maven2/!junit:junit:LATEST:jar";); } + @Test + public void doctypeInMetadataKeepsRequestedVersion() throws Exception { + final File external = File.createTempFile("metadata", ".txt"); + external.deleteOnExit(); + try (final FileOutputStream out = new FileOutputStream(external)) { + out.write("1.2.3".getBytes("UTF-8")); + } + + final String xml = "<?xml version=\"1.0\"?>\n" + + "<!DOCTYPE metadata [<!ENTITY ext SYSTEM \"" + external.toURI().toURL() + "\">]>\n" + + "<metadata><versioning><release>&ext;</release><latest>&ext;</latest></versioning></metadata>"; + final ByteArrayOutputStream metadata = new ByteArrayOutputStream(); + metadata.write(xml.getBytes("UTF-8")); + + final Method extract = MavenResolver.class.getDeclaredMethod("extractRealVersion", String.class, ByteArrayOutputStream.class); + extract.setAccessible(true); + assertEquals("LATEST", extract.invoke(null, "LATEST", metadata)); + } + @Test public void overrideRepo() throws Exception { System.setProperty("openejb.deployer.repository", "https://bob.smith/repo/";);
