MENDELU/Security patches from vanilla DSpace 9.3 (CVE-2026-49830..49833 incl. LDN RCE)#1336
Open
milanmajchrak wants to merge 20 commits into
Open
MENDELU/Security patches from vanilla DSpace 9.3 (CVE-2026-49830..49833 incl. LDN RCE)#1336milanmajchrak wants to merge 20 commits into
milanmajchrak wants to merge 20 commits into
Conversation
* Safer Velocity configuration * New "message.templates.allowed-config" config * Remove "UnmodifiableConfiguration" in favour of a simple Map of whitelisted Config keys/values * Centralise Velocity config in core Utils * Small javadoc changes (cherry picked from commit b2d6141) (cherry picked from commit 9b4e48f)
(cherry picked from commit 65092e1)
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security patches from vanilla DSpace 9.3
This branch is based on DSpace 9.1, which is affected by all four security advisories fixed in DSpace 9.3 (2026-05-28). This PR cherry-picks the complete security set from upstream
dspace-9_x:SecureUberspector, restricted introspection), only allowlisted config exposed to Email/LDN templatesSecureFileAccessvalidatorSecureFileAccess, allowed base paths,-T/-rCLI-onlyGlobalRequestSecurityFilterrejecting path-traversal/JSP request patternsConfig changes
dspace.cfg: newmessage.templates.allowed-configallowlist (config keys exposed to Email/LDN Velocity templates)config/modules/curate.cfg: commentedcurate.taskfile.base/curate.reporter.basedefaultsconfig/modules/oai.cfg: commented ORE harvester URL-prefix allowlistconfig/modules/ldn.cfgarea: LDN template path restrictionsBehavioral notes
message.templates.allowed-configif custom templates reference other${config...}values.-T(taskFile) /-r(reporter) options are CLI-only now.Note
The rest of the dataquest customer branches are DSpace 7.6.x and received the equivalent 7.6.7 patch set in separate PRs. This branch needed the 9_x variants (jakarta-based + the LDN fixes which only exist in DSpace 8+).
Verification
mvn package(dspace-api + dspace-server-webapp) passes locally.🤖 Generated with Claude Code