bamaer opened a new pull request, #8368: URL: https://github.com/apache/hop/pull/8368
…lidation Fixes #8367 The XSD Validator transform and action defaulted ALLOW_EXTERNAL_ENTITIES_FOR_XSD_VALIDATION_DEFAULT to "true", so the hardened code path both of them already carried was never taken. Both constants are now "false"; the checkbox in either dialog and the system property still override it. Flipping the default exposed that the hardened path did not work on Hop's own classpath. createSecureSchemaFactory() sets ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_SCHEMA, and Xerces' XMLSchemaFactory - the SchemaFactory that xercesImpl contributes to the Hop runtime - throws SAXNotRecognizedException for both, so every validation failed with "Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized." hop-core's tests missed it because core has no Xerces and gets the JDK factory. The two property calls are now best-effort, the same way createSecureXmlInputFactory() already handles Woodstox, and when they are unrecognized an LSResourceResolver enforces the identical policy: external DTDs refused, xs:include / xs:import allowed on file: only, anything else refused without a fetch. Tests: SecureSchemaFactoryTest runs on the transform module's classpath, where Xerces is present, and uses a loopback HTTP server to assert the secure factory issues zero requests while a plain SchemaFactory issues one. Integration tests 0021 (transform) and 0022 (action) in the xml project drive the same three cases end to end against the suite's file server. Note that this is a behaviour change for newly created transforms and actions, and that XSD source "is defined inside the XML" stops working while external entities are off. **Please** add a meaningful description for your change here ------------------------ Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily: - [x] Run `mvn clean install apache-rat:check` to make sure basic checks pass. A more thorough check will be performed on your pull request automatically. - [x] If you have a group of commits related to the same change, please squash your commits into one and force push your branch using `git rebase -i`. - [x] Mention the appropriate issue in your description (for example: `addresses #123`), if applicable. To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) you have to acknowledge this by using the following check-box. - [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) - [ ] In any other case, please file an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
