Skip to content

Commit 5e9e61a

Browse files
ubkmubkm
committed
Patch XML Parsing Updates IQSS#11619, fixing Security alert: XXE Vulnerabilities
1 parent 7321ec0 commit 5e9e61a

29 files changed

Lines changed: 1356 additions & 93 deletions

File tree

‎doc/release-notes/xmlutil.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
The configuration of XML parsers used in Dataverse has been centralized and unused functionality has been turned off to enhance security.

‎local_lib/io/gdcc/xoai-common/5.3.2.1-local/xoai-common-5.3.2.1-local.jar‎

74.7 KB
Binary file not shown.

‎local_lib/io/gdcc/xoai-common/5.3.2.1-local/xoai-common-5.3.2.1-local.pom‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ The contents of this file are subject to the license and copyright
4+
~ detailed in the LICENSE and NOTICE files at the root of the source
5+
~ tree and available online at
6+
~
7+
~ http://www.dspace.org/license/
8+
-->
9+
10+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
11+
<parent>
12+
<artifactId>xoai</artifactId>
13+
<groupId>io.gdcc</groupId>
14+
<version>5.3.2.1-local</version>
15+
</parent>
16+
<modelVersion>4.0.0</modelVersion>
17+
18+
<name>XOAI Commons</name>
19+
<artifactId>xoai-common</artifactId>
20+
<description>OAI-PMH base functionality used for both data and service providers.</description>
21+
22+
<dependencies>
23+
<dependency>
24+
<groupId>jakarta.xml.bind</groupId>
25+
<artifactId>jakarta.xml.bind-api</artifactId>
26+
</dependency>
27+
<dependency>
28+
<groupId>org.hamcrest</groupId>
29+
<artifactId>hamcrest</artifactId>
30+
<!-- This library is not just used within tests, we also use it to match within real code! -->
31+
<scope>compile</scope>
32+
</dependency>
33+
<dependency>
34+
<groupId>io.gdcc</groupId>
35+
<artifactId>xoai-xmlio</artifactId>
36+
</dependency>
37+
<dependency>
38+
<groupId>org.codehaus.woodstox</groupId>
39+
<artifactId>stax2-api</artifactId>
40+
</dependency>
41+
<!--
42+
We need an actual StAX2 implementation at runtime (thus the scope). Yet appservers like Payara already ship
43+
their version and using it should be just fine, so we prevent packaging the dep in the JAR via <optional>.
44+
(Someone might also want to switch to another StAX2 engine like Aalto.)
45+
-->
46+
<dependency>
47+
<groupId>com.fasterxml.woodstox</groupId>
48+
<artifactId>woodstox-core</artifactId>
49+
<scope>runtime</scope>
50+
<optional>true</optional>
51+
</dependency>
52+
53+
<!-- TESTING DEPENDENCIES -->
54+
<dependency>
55+
<groupId>org.junit.jupiter</groupId>
56+
<artifactId>junit-jupiter</artifactId>
57+
<scope>test</scope>
58+
</dependency>
59+
<dependency>
60+
<groupId>org.xmlunit</groupId>
61+
<artifactId>xmlunit-core</artifactId>
62+
<scope>test</scope>
63+
</dependency>
64+
<dependency>
65+
<groupId>org.xmlunit</groupId>
66+
<artifactId>xmlunit-matchers</artifactId>
67+
<scope>test</scope>
68+
</dependency>
69+
<dependency>
70+
<groupId>org.openjdk.jmh</groupId>
71+
<artifactId>jmh-core</artifactId>
72+
<version>1.37</version>
73+
<scope>test</scope>
74+
</dependency>
75+
<dependency>
76+
<groupId>org.openjdk.jmh</groupId>
77+
<artifactId>jmh-generator-annprocess</artifactId>
78+
<version>1.37</version>
79+
<scope>test</scope>
80+
</dependency>
81+
</dependencies>
82+
</project>

‎local_lib/io/gdcc/xoai-data-provider/5.3.2.1-local/xoai-data-provider-5.3.2.1-local.jar‎

71.5 KB
Binary file not shown.

‎local_lib/io/gdcc/xoai-data-provider/5.3.2.1-local/xoai-data-provider-5.3.2.1-local.pom‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ The contents of this file are subject to the license and copyright
4+
~ detailed in the LICENSE and NOTICE files at the root of the source
5+
~ tree and available online at
6+
~
7+
~ http://www.dspace.org/license/
8+
-->
9+
10+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
11+
<parent>
12+
<artifactId>xoai</artifactId>
13+
<groupId>io.gdcc</groupId>
14+
<version>5.3.2.1-local</version>
15+
</parent>
16+
17+
<modelVersion>4.0.0</modelVersion>
18+
19+
<name>XOAI Data Provider</name>
20+
<artifactId>xoai-data-provider</artifactId>
21+
<description>OAI-PMH data provider implementation. Use it to build an OAI-PMH endpoint, providing your data records as harvestable resources.</description>
22+
23+
<build>
24+
<plugins>
25+
<plugin>
26+
<groupId>org.apache.maven.plugins</groupId>
27+
<artifactId>maven-jar-plugin</artifactId>
28+
<executions>
29+
<execution>
30+
<goals>
31+
<goal>test-jar</goal>
32+
</goals>
33+
</execution>
34+
</executions>
35+
</plugin>
36+
</plugins>
37+
</build>
38+
39+
<dependencies>
40+
<dependency>
41+
<groupId>io.gdcc</groupId>
42+
<artifactId>xoai-common</artifactId>
43+
<version>${project.version}</version>
44+
</dependency>
45+
<dependency>
46+
<groupId>org.slf4j</groupId>
47+
<artifactId>slf4j-api</artifactId>
48+
</dependency>
49+
50+
<!-- TESTING DEPENDENCIES -->
51+
<dependency>
52+
<groupId>org.junit.jupiter</groupId>
53+
<artifactId>junit-jupiter</artifactId>
54+
<scope>test</scope>
55+
</dependency>
56+
<dependency>
57+
<groupId>org.xmlunit</groupId>
58+
<artifactId>xmlunit-core</artifactId>
59+
<scope>test</scope>
60+
</dependency>
61+
<dependency>
62+
<groupId>org.xmlunit</groupId>
63+
<artifactId>xmlunit-matchers</artifactId>
64+
<scope>test</scope>
65+
</dependency>
66+
<dependency>
67+
<groupId>org.slf4j</groupId>
68+
<artifactId>slf4j-simple</artifactId>
69+
<scope>test</scope>
70+
</dependency>
71+
</dependencies>
72+
</project>

‎local_lib/io/gdcc/xoai-service-provider/5.3.2.1-local/xoai-service-provider-5.3.2.1-local.jar‎

64.4 KB
Binary file not shown.

‎local_lib/io/gdcc/xoai-service-provider/5.3.2.1-local/xoai-service-provider-5.3.2.1-local.pom‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ The contents of this file are subject to the license and copyright
4+
~ detailed in the LICENSE and NOTICE files at the root of the source
5+
~ tree and available online at
6+
~
7+
~ http://www.dspace.org/license/
8+
-->
9+
10+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
11+
<parent>
12+
<groupId>io.gdcc</groupId>
13+
<artifactId>xoai</artifactId>
14+
<version>5.3.2.1-local</version>
15+
</parent>
16+
<modelVersion>4.0.0</modelVersion>
17+
18+
<name>XOAI Service Provider</name>
19+
<artifactId>xoai-service-provider</artifactId>
20+
<description>OAI-PMH service provider implementation. Use it as a harvesting client to read remote repositories.</description>
21+
22+
<dependencies>
23+
<dependency>
24+
<groupId>io.gdcc</groupId>
25+
<artifactId>xoai-common</artifactId>
26+
<version>${project.version}</version>
27+
</dependency>
28+
<dependency>
29+
<groupId>io.gdcc</groupId>
30+
<artifactId>xoai-xmlio</artifactId>
31+
<version>${project.version}</version>
32+
</dependency>
33+
34+
<dependency>
35+
<groupId>org.slf4j</groupId>
36+
<artifactId>slf4j-api</artifactId>
37+
</dependency>
38+
39+
<!-- TESTING DEPENDENCIES -->
40+
<dependency>
41+
<groupId>io.gdcc</groupId>
42+
<artifactId>xoai-data-provider</artifactId>
43+
<version>${project.version}</version>
44+
<scope>test</scope>
45+
</dependency>
46+
<dependency>
47+
<groupId>io.gdcc</groupId>
48+
<artifactId>xoai-data-provider</artifactId>
49+
<version>${project.version}</version>
50+
<type>test-jar</type>
51+
<scope>test</scope>
52+
</dependency>
53+
<dependency>
54+
<groupId>org.junit.jupiter</groupId>
55+
<artifactId>junit-jupiter</artifactId>
56+
<scope>test</scope>
57+
</dependency>
58+
<dependency>
59+
<groupId>org.slf4j</groupId>
60+
<artifactId>slf4j-simple</artifactId>
61+
<scope>test</scope>
62+
</dependency>
63+
</dependencies>
64+
65+
</project>

‎local_lib/io/gdcc/xoai-xmlio/5.3.2.1-local/xoai-xmlio-5.3.2.1-local.jar‎

25.8 KB
Binary file not shown.

‎local_lib/io/gdcc/xoai-xmlio/5.3.2.1-local/xoai-xmlio-5.3.2.1-local.pom‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
2+
<modelVersion>4.0.0</modelVersion>
3+
4+
<parent>
5+
<groupId>io.gdcc</groupId>
6+
<artifactId>xoai</artifactId>
7+
<version>5.3.2.1-local</version>
8+
</parent>
9+
10+
<artifactId>xoai-xmlio</artifactId>
11+
<packaging>jar</packaging>
12+
<name>XOAI XML IO Commons</name>
13+
<description>Basic XML IO routines used for XOAI OAI-PMH implementation. Forked from obsolete Lyncode sources.</description>
14+
15+
<licenses>
16+
<license>
17+
<name>The Apache Software License, Version 2.0</name>
18+
<url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
19+
<distribution>repo</distribution>
20+
</license>
21+
</licenses>
22+
23+
<dependencies>
24+
<dependency>
25+
<groupId>org.codehaus.woodstox</groupId>
26+
<artifactId>stax2-api</artifactId>
27+
</dependency>
28+
<!--
29+
We need an actual StAX2 implementation at runtime (thus the scope). Yet appservers like Payara already ship
30+
their version and using it should be just fine, so we prevent packaging the dep in the JAR via <optional>.
31+
(Someone might also want to switch to another StAX2 engine like Aalto.)
32+
-->
33+
<dependency>
34+
<groupId>com.fasterxml.woodstox</groupId>
35+
<artifactId>woodstox-core</artifactId>
36+
<scope>runtime</scope>
37+
<optional>true</optional>
38+
</dependency>
39+
40+
<!-- This library is not just used within tests, we also use it to match within real code! -->
41+
<dependency>
42+
<groupId>org.hamcrest</groupId>
43+
<artifactId>hamcrest</artifactId>
44+
</dependency>
45+
46+
<!-- TESTING DEPENDENCIES -->
47+
<dependency>
48+
<groupId>org.xmlunit</groupId>
49+
<artifactId>xmlunit-core</artifactId>
50+
<scope>test</scope>
51+
</dependency>
52+
<dependency>
53+
<groupId>org.xmlunit</groupId>
54+
<artifactId>xmlunit-matchers</artifactId>
55+
<scope>test</scope>
56+
</dependency>
57+
<dependency>
58+
<groupId>org.junit.jupiter</groupId>
59+
<artifactId>junit-jupiter</artifactId>
60+
<scope>test</scope>
61+
</dependency>
62+
</dependencies>
63+
</project>

0 commit comments

Comments
 (0)
⚡