-
-
Notifications
You must be signed in to change notification settings - Fork 3.7k
HHH-18455 Strict XML validation compliance #9558
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
1f4b365
to
551447f
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Perhaps InputstreamRepeatableAccess would be a better name for this ...
I also wonder about what to do (if anything) with that chunk of memory the byte[] occupies, once this repeatable access is no longer needed; should there be some mechanism to release this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hey @jrenaat 👋🏻 😃
I remembered that we have something for XML validation in Validator code here: https://github.com/hibernate/hibernate-validator/blob/b14c620a3f7d93a322fa122b52e1b9e83c376c35/engine/src/main/java/org/hibernate/validator/internal/xml/mapping/MappingXmlParser.java#L98-L143
you'll see that that code relies on InputStream#mark()
/InputStream#reset()
instead of keeping all the file. And the way we make sure that these methods are "supported" by the stream is here:
https://github.com/hibernate/hibernate-validator/blob/b14c620a3f7d93a322fa122b52e1b9e83c376c35/engine/src/main/java/org/hibernate/validator/internal/engine/AbstractConfigurationImpl.java#L287
IDK if that would be applicable here or not, but I thought I'd let you know about it, and you can then decide 😃.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the pointers. I did consider the mark/reset approach but i'm not 100% it would work in our case, i think we actually need 2 separate inputstreams.
551447f
to
25cc853
Compare
25cc853
to
aa45191
Compare
aa45191
to
18e4484
Compare
Thanks for your pull request! This pull request appears to follow the contribution rules. › This message was automatically generated. |
18e4484
to
8c5bafa
Compare
hibernate-core/src/main/java/org/hibernate/boot/jaxb/spi/Binder.java
Outdated
Show resolved
Hide resolved
hibernate-core/src/main/java/org/hibernate/boot/jaxb/internal/AbstractBinder.java
Outdated
Show resolved
Hide resolved
hibernate-core/src/test/java/org/hibernate/orm/test/boot/jaxb/mapping/OrmXmlValidationTest.java
Fixed
Show fixed
Hide fixed
hibernate-core/src/test/java/org/hibernate/orm/test/boot/jaxb/mapping/OrmXmlValidationTest.java
Fixed
Show fixed
Hide fixed
hibernate-core/src/test/java/org/hibernate/orm/test/boot/jaxb/mapping/OrmXmlValidationTest.java
Fixed
Show fixed
Hide fixed
hibernate-core/src/test/java/org/hibernate/orm/test/boot/jaxb/mapping/OrmXmlValidationTest.java
Fixed
Show fixed
Hide fixed
hibernate-core/src/test/java/org/hibernate/orm/test/boot/jaxb/mapping/OrmXmlValidationTest.java
Fixed
Show fixed
Hide fixed
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Left some comments.
Let's chat about it some more and work through those.
@@ -36,15 +38,18 @@ public abstract class AbstractBinder<T> implements Binder<T> { | |||
|
|||
private final LocalXmlResourceResolver xmlResourceResolver; | |||
|
|||
protected InputStreamAccess streamAccess; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Really not a fan of storing this as an inst var here. As an illustration of why, the only use of it actually does not even check whether it is null prior to using it even though only 1 of the 2 exposed methods actually sets it (and then only in 1 of the 2 impls).
I think we need to think about a way to not store this as an inst var, especially here.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pass it as a parameter to the doBind methods?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think that's great either. Basically there are 2 forms of bind
here - one accepting a Source
and one accepting a InputStream(Access)
.
Possibly having our XMLEventReader
impls have a way to reset or rebuild themselves?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe we say we don't care about this for the Source
forms...
As far as I can see, there are 2 places where the Source
form comes into play and I think neither is a real problem:
org.hibernate.boot.jaxb.internal.XmlSources#fromDocument
wraps the DOM document as aSource
. We no longer use thisXmlSources#fromDocument
method (as we no longer support DOM) and since its internal we could deprecate or even remove it.org.hibernate.jpa.boot.spi.PersistenceXmlParser#loadUrlWithJaxb
which is loading configuration and chooses to wrap anInputStream
as aStreamSource
to pass to the binder. But (a) we could instead wrap it as aInputStreamAccess
and (b) we don't really care about strict validation for configuration files.
So maybe a better holostic strategy here is to:
- Deprecate
Binder#bind(Source, Origin)
- Remove
XmlSources#fromDocument
(its internal and we do not use it) - Change
PersistenceXmlParser#loadUrlWithJaxb
to pass theInputStream(Access)
- Change
AbstractBinder#createReader
to return a XMLEventReader whihc provides access to the underlyingInputStreamAccess
. In the (now deprecated) cases that aSource
was used, that reader would just throw an exception.
wdyt?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
One other thing... you changed the signature of Binder#bind(InputStream,Origin)
to Binder#bind(InputStreamAccess,Origin)
. Technically Binder
is an SPI and we really ought to not be changing that.
However, we could deprecate the old form in favor of a new one with that signature, the old form just wrapping the passed InputStream
as an InputStreamAccess
and calling the new form.
8c5bafa
to
3626420
Compare
…to bind(InputStreamAccess, Origin) to allow repeatable access to the InputStream, needed for strict Jpa XML validation HHH-18455 - Implement option to run strict JPA compliance validation Signed-off-by: Jan Schatteman <[email protected]>
Signed-off-by: Jan Schatteman <[email protected]>
Introduce JaxbBindingSource interface to avoid needing an InputStreamAccess instance variable inside AbtractBinder Remove unused XmlSources.fromDocument Remove unused JaxpSourceXmlSource Signed-off-by: Jan Schatteman <[email protected]>
3626420
to
084dfbc
Compare
public XMLEventReader getEventReader() { | ||
try { | ||
// create a standard StAX reader | ||
final XMLEventReader staxReader = staxFactory().createXMLEventReader( streamAccess.accessInputStream() ); |
Check failure
Code scanning / CodeQL
Resolving XML external entity in user-controlled data Critical
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license
and can be relicensed under the terms of the LGPL v2.1 license in the future at the maintainers' discretion.
For more information on licensing, please check here.
https://hibernate.atlassian.net/browse/HHH-18455