PALO/Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831) by milanmajchrak · Pull Request #1331 · dataquest-dev/DSpace

milanmajchrak · 2026-06-11T09:28:18Z

Security patches from vanilla DSpace 7.6.7

DSpace 7.6.7 (final 7.x release, 2026-05-28) shipped a coordinated set of security fixes. This branch was missing all of them. This PR cherry-picks the complete set from upstream dspace-7_x:

Advisory	CVE	Fix	Upstream PR
GHSA-c827-pw3m-67w7	CVE-2026-49830 (medium)	ORE aggregated resource URI validation (scheme + host allowlist) in `OREIngestionCrosswalk`	DSpace#12542
GHSA-v66x-68f2-pxf5	CVE-2026-49831 (medium)	Curation Task Reporter path traversal: new `SecureFileAccess`, curation output restricted to allowed base paths	DSpace#12539
(hardening)	—	Velocity template safety for Email: `SecureUberspector`, restricted introspection, only allowlisted config exposed to templates	DSpace#12546
(hardening)	—	`GlobalRequestSecurityFilter`: rejects path-traversal/JSP request patterns at the REST webapp boundary	DSpace#12550

Config changes

dspace.cfg: new message.templates.allowed-config allowlist (config keys exposed to email templates)
config/modules/curate.cfg: new commented curate.taskfile.base / curate.reporter.base options
config/modules/oai.cfg: new commented ORE harvester URL-prefix allowlist option

Behavioral notes

Curation -T (taskFile) and -r (reporter) options are now CLI-only — they can no longer be passed to REST-triggered processes (this is the CVE-2026-49831 fix).
Path-traversal requests (e.g. to /sitemaps) now return 403 instead of 400 (test expectations updated).
Email Velocity templates only see config keys listed in message.templates.allowed-config (default: dspace.name, dspace.shortname, dspace.ui.url, mail.helpdesk, mail.message.helpdesk.telephone, mail.admin, mail.admin.name). If a customer template references other ${config...} keys, add them to this list.

Intentionally not included

Upstream [Port dspace-7_x] Disable most file formats for "inline" display (in a user's browser) by default, unless overridden by configuration. DSpace/DSpace#12149 (webui.content_disposition_inline allowlist rework) — changes default inline-display behavior; left for a separate decision.

Verification

mvn package (dspace-api + dspace-server-webapp) passes locally.
Full unit + integration test suite runs via CI on this PR.

🤖 Generated with Claude Code

(cherry picked from commit 7ac17f6)

* Safer Velocity configuration * New "message.templates.allowed-config" config * Remove "UnmodifiableConfiguration" in favour of a simple Map of whitelisted Config keys/values * Centralise Velocity config in core Utils * Small javadoc changes (cherry picked from commit b2d6141) (cherry picked from commit 5b31db5)

(cherry picked from commit 6b66531) (cherry picked from commit 46a0dfb)

(cherry picked from commit 5803819) (cherry picked from commit 4be430f)

(cherry picked from commit 655fc62)

(cherry picked from commit cf9be85) (cherry picked from commit dc3e455)

(cherry picked from commit 295a046) (cherry picked from commit 0b1deae)

(cherry picked from commit e2e6a79) (cherry picked from commit 2e40077)

(cherry picked from commit 56ae287) (cherry picked from commit 1a3dfd7)

(cherry picked from commit 8a2eee9)

(cherry picked from commit 22bec44)

Removes some JDK >= 16 usage (cherry picked from commit 55905a2)

(cherry picked from commit 4502224)

(cherry picked from commit 277af82)

(cherry picked from commit a757221)

(cherry picked from commit 6437472) (cherry picked from commit 37cd6eb)

(cherry picked from commit 00e4979) (cherry picked from commit 27708ea)

coderabbitai · 2026-06-11T09:28:26Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7d1155b5-3635-44f4-bf39-8e557adcdb9b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…ntifiersIT is run before WorkflowCurationIT, it was causing the latter to fail. (cherry picked from commit 816dfbe) (cherry picked from commit 6a781f6)

kshepherd added 17 commits June 11, 2026 10:56

ORE aggregated resource URI validation

8432a64

(cherry picked from commit 7ac17f6)

Better null checking in allowed config props

3b3de1e

(cherry picked from commit 6b66531) (cherry picked from commit 46a0dfb)

Access configurationService at runtime, not rely on class setup

4d0d12e

(cherry picked from commit 5803819) (cherry picked from commit 4be430f)

Remove strict mode Velocity engine configuration (allow nulls)

00eea95

(cherry picked from commit 655fc62)

Filter requests for JSPs or traversal

5596fb2

(cherry picked from commit cf9be85) (cherry picked from commit dc3e455)

Add additional logging to GlobalRequestSecurityFilter

7128dfa

(cherry picked from commit 295a046) (cherry picked from commit 0b1deae)

Fix import order

89f2a3d

(cherry picked from commit e2e6a79) (cherry picked from commit 2e40077)

Update sitemap traversal test expectations

b504e4a

(cherry picked from commit 56ae287) (cherry picked from commit 1a3dfd7)

Backport GlobalRequestSecurityFilter for javax

90b2a58

(cherry picked from commit 8a2eee9)

Add secure file access methods

215f427

(cherry picked from commit 22bec44)

Backport Curation I/O using secure file access

b07ab74

Removes some JDK >= 16 usage (cherry picked from commit 55905a2)

Curation config support for allowed base paths

3e6af59

(cherry picked from commit 4502224)

Move curation -r reporter param to CLI only

9358a7e

(cherry picked from commit 277af82)

Fix import order

0d088ec

(cherry picked from commit a757221)

Ignore CurationScriptIT -T taskFile tests, to rewrite w/ CLI

e271945

(cherry picked from commit 6437472) (cherry picked from commit 37cd6eb)

Move taskfile -T option to CLI script config only

fa2b964

(cherry picked from commit 00e4979) (cherry picked from commit 27708ea)

Fix broken tests due to random order execution. When CreateMissingIde…

e45020b

…ntifiersIT is run before WorkflowCurationIT, it was causing the latter to fail. (cherry picked from commit 816dfbe) (cherry picked from commit 6a781f6)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PALO/Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831)#1331

PALO/Security patches from vanilla DSpace 7.6.7 (CVE-2026-49830, CVE-2026-49831)#1331
milanmajchrak wants to merge 18 commits into
customer/palo-dockerfrom
palo-docker-security-patches-7.6.7

milanmajchrak commented Jun 11, 2026

Uh oh!

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

milanmajchrak commented Jun 11, 2026

Security patches from vanilla DSpace 7.6.7

Config changes

Behavioral notes

Intentionally not included

Verification

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading