UFAL/Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831)#1330
Open
milanmajchrak wants to merge 20 commits into
Open
UFAL/Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831)#1330milanmajchrak wants to merge 20 commits into
milanmajchrak wants to merge 20 commits into
Conversation
(cherry picked from commit 7ac17f6)
* Safer Velocity configuration * New "message.templates.allowed-config" config * Remove "UnmodifiableConfiguration" in favour of a simple Map of whitelisted Config keys/values * Centralise Velocity config in core Utils * Small javadoc changes (cherry picked from commit b2d6141) (cherry picked from commit 5b31db5)
(cherry picked from commit 655fc62)
(cherry picked from commit 8a2eee9)
(cherry picked from commit 22bec44)
Removes some JDK >= 16 usage (cherry picked from commit 55905a2)
(cherry picked from commit 4502224)
(cherry picked from commit 277af82)
(cherry picked from commit a757221)
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The bitstream format registry on this branch contains 107 formats but the test still expected 95, so the create* tests have been failing on the base branch as well (pre-existing). Align the constant with the actual registry content.
The format count in the test DB depends on test class execution order (other test classes on this branch leak formats into the registry), so the create* tests randomly failed with a fixed expected constant - both on this branch and on the base branch. Capture the current count before each create attempt and assert relative to it, instead of relying on DEFAULT_AMOUNT_FORMATS.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security patches from vanilla DSpace 7.6.7
DSpace 7.6.7 (final 7.x release, 2026-05-28) shipped a coordinated set of security fixes. This branch was missing all of them. This PR cherry-picks the complete set from upstream
dspace-7_x:OREIngestionCrosswalkSecureFileAccess, curation output restricted to allowed base pathsSecureUberspector, restricted introspection, only allowlisted config exposed to templatesGlobalRequestSecurityFilter: rejects path-traversal/JSP request patterns at the REST webapp boundaryConfig changes
dspace.cfg: newmessage.templates.allowed-configallowlist (config keys exposed to email templates)config/modules/curate.cfg: new commentedcurate.taskfile.base/curate.reporter.baseoptionsconfig/modules/oai.cfg: new commented ORE harvester URL-prefix allowlist optionBehavioral notes
-T(taskFile) and-r(reporter) options are now CLI-only — they can no longer be passed to REST-triggered processes (this is the CVE-2026-49831 fix)./sitemaps) now return 403 instead of 400 (test expectations updated).message.templates.allowed-config(default: dspace.name, dspace.shortname, dspace.ui.url, mail.helpdesk, mail.message.helpdesk.telephone, mail.admin, mail.admin.name). If a customer template references other${config...}keys, add them to this list.Intentionally not included
webui.content_disposition_inlineallowlist rework) — changes default inline-display behavior; left for a separate decision.Verification
mvn package(dspace-api + dspace-server-webapp) passes locally.🤖 Generated with Claude Code