ZCU-DATA/Security patches from vanilla DSpace 7.6.x (CVE-2024-38364, CVE-2025-53621/53622, CVE-2026-49830/49831)#1334

Open

milanmajchrak wants to merge 35 commits into

customer/zcu-datafrom

zcu-data/security-patches-7.6.7

Commits on Jun 11, 2026

Avoid inline display of HTML/JS bitstreams. Add JS to list of known formats so that it can be recognized by DSpace.

tdonohue
authored and
milanmajchrak
committed
For additional security, ensure "unknown" formats are always downloaded. Update test to prove behavior.

tdonohue
authored and
milanmajchrak
committed
To avoid misconfiguration, hardcode HTML, XML, RDF, JS to download only. Add a new wildcard setting to allow sites to force all files to download only.

tdonohue
authored and
milanmajchrak
committed
Potential fix for code scanning alert no. 30: Resolving XML external entity in user-controlled data

authored and
milanmajchrak
committed
Cannot disable DTDs with PubMed, so instead disallow external entities & entity expansion

tdonohue
authored and
milanmajchrak
committed
Potential fix for code scanning alert no. 3549: Arbitrary file access during archive extraction ("Zip Slip")

authored and
milanmajchrak
committed
Safe and consistent XML entity handling in parsers

kshepherd
authored and
milanmajchrak
committed
EPO and PubMed only need to allow for DOCTYPEs. All other XML security changes can be used.

tdonohue
authored and
milanmajchrak
committed
Allow trusted XML builder to enforce base path for entities

kshepherd
authored and
milanmajchrak
committed
Enforce path traversal check on import subdir (pre-processing)

kshepherd
authored and
milanmajchrak
committed
Re-add file separator to normalized SAF item path

kshepherd
authored and
milanmajchrak
committed
Remove unused imports

kshepherd
authored and
milanmajchrak
committed
Fix missing XMLUtils imports

kshepherd
authored and
milanmajchrak
committed
fix: prevent path traversal in SAF import

MMilosz
authored and
milanmajchrak
committed
Enforce bitstream path to be within (fs) bitstore base on get

kshepherd
authored and
milanmajchrak
committed
return existing File constructed and validated for bitstream

kshepherd
authored and
milanmajchrak
committed
Fix line length in DSBitstore log

kshepherd
authored and
milanmajchrak
committed
ORE aggregated resource URI validation

kshepherd
authored and
milanmajchrak
committed
Velocity and template safety for Email and LDN messages

kshepherd
authored and
milanmajchrak
committed
Better null checking in allowed config props

kshepherd
authored and
milanmajchrak
committed
Access configurationService at runtime, not rely on class setup

kshepherd
authored and
milanmajchrak
committed
Remove strict mode Velocity engine configuration (allow nulls)

kshepherd
authored and
milanmajchrak
committed
Filter requests for JSPs or traversal

kshepherd
authored and
milanmajchrak
committed
Add additional logging to GlobalRequestSecurityFilter

kshepherd
authored and
milanmajchrak
committed
Fix import order

kshepherd
authored and
milanmajchrak
committed
Update sitemap traversal test expectations

kshepherd
authored and
milanmajchrak
committed
Backport GlobalRequestSecurityFilter for javax

kshepherd
authored and
milanmajchrak
committed
Add secure file access methods

kshepherd
authored and
milanmajchrak
committed
Backport Curation I/O using secure file access

kshepherd
authored and
milanmajchrak
committed
Curation config support for allowed base paths

kshepherd
authored and
milanmajchrak
committed
Move curation -r reporter param to CLI only

kshepherd
authored and
milanmajchrak
committed
Fix import order

kshepherd
authored and
milanmajchrak
committed
Ignore CurationScriptIT -T taskFile tests, to rewrite w/ CLI

kshepherd
authored and
milanmajchrak
committed
Move taskfile -T option to CLI script config only

kshepherd
authored and
milanmajchrak
committed
Fix failing IT by increasing number of formats by one
milanmajchrak
committed