From 12d761bfaff6759fdd51f85e5f77a5424ffc37c2 Mon Sep 17 00:00:00 2001 From: "Matteo E. Minnai" Date: Tue, 23 Jun 2026 12:54:27 +0200 Subject: [PATCH 1/4] ESB-1146 Updated EntSafeXmlUtils to generate a safer SAXBuilder for XML generation --- .../services/resource/parse/ImageDimensionDOM.java | 3 ++- .../content/parse/ContentThreadConfigDOM.java | 3 ++- .../services/notifier/parse/WorkflowNotifierDOM.java | 5 +++-- .../services/workflow/parse/ContentWorkflowDOM.java | 3 ++- .../parse/AbstractAttributeSupportObjectDOM.java | 2 +- .../aps/system/common/entity/parse/EntityTypeDOM.java | 3 ++- .../system/services/baseconfig/SystemParamsUtils.java | 3 ++- .../agiletec/aps/system/services/lang/LangDOM.java | 3 ++- .../aps/system/services/page/PageExtraConfigDOM.java | 3 ++- .../aps/system/services/pagemodel/PageModelDOM.java | 5 +++-- .../java/com/agiletec/aps/util/ApsPropertiesDOM.java | 3 ++- .../aps/system/init/model/DataSourceDumpReport.java | 3 ++- .../system/init/model/SystemInstallationReport.java | 3 ++- .../entando/aps/system/init/util/ComponentDefDOM.java | 2 +- .../aps/system/services/api/ApiResourcesDefDOM.java | 2 +- .../system/services/api/ServiceExtraConfigDOM.java | 3 ++- .../aps/system/services/widgettype/WidgetTypeDOM.java | 3 ++- .../org/entando/entando/ent/util/EntSafeXmlUtils.java | 11 +++++++++++ .../jpmail/aps/services/mail/parse/MailConfigDOM.java | 3 ++- .../jpseo/aps/system/services/metatag/MetatagDOM.java | 3 ++- .../system/services/page/SeoPageExtraConfigDOM.java | 3 ++- 21 files changed, 50 insertions(+), 22 deletions(-) diff --git a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/parse/ImageDimensionDOM.java b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/parse/ImageDimensionDOM.java index ecb9cddf6b..8fedea2339 100644 --- a/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/parse/ImageDimensionDOM.java +++ b/cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/parse/ImageDimensionDOM.java @@ -21,6 +21,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; @@ -85,7 +86,7 @@ public Map getDimensions() { } private void decodeDOM(String xmlText) throws EntException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/contentscheduler-plugin/src/main/java/org/entando/entando/plugins/jpcontentscheduler/aps/system/services/content/parse/ContentThreadConfigDOM.java b/contentscheduler-plugin/src/main/java/org/entando/entando/plugins/jpcontentscheduler/aps/system/services/content/parse/ContentThreadConfigDOM.java index 01b09b2f8e..3380625d44 100644 --- a/contentscheduler-plugin/src/main/java/org/entando/entando/plugins/jpcontentscheduler/aps/system/services/content/parse/ContentThreadConfigDOM.java +++ b/contentscheduler-plugin/src/main/java/org/entando/entando/plugins/jpcontentscheduler/aps/system/services/content/parse/ContentThreadConfigDOM.java @@ -39,6 +39,7 @@ import org.jdom2.Document; import org.jdom2.Element; import org.jdom2.JDOMException; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.XMLOutputter; @@ -444,7 +445,7 @@ private Element createMailElement(ContentThreadConfig config) { * In case of parsing exceptions. */ private Element getRootElement(String xmlText) throws EntException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); Element root = null; diff --git a/contentworkflow-plugin/src/main/java/com/agiletec/plugins/jpcontentworkflow/aps/system/services/notifier/parse/WorkflowNotifierDOM.java b/contentworkflow-plugin/src/main/java/com/agiletec/plugins/jpcontentworkflow/aps/system/services/notifier/parse/WorkflowNotifierDOM.java index 20f25010ce..6f62b383cd 100644 --- a/contentworkflow-plugin/src/main/java/com/agiletec/plugins/jpcontentworkflow/aps/system/services/notifier/parse/WorkflowNotifierDOM.java +++ b/contentworkflow-plugin/src/main/java/com/agiletec/plugins/jpcontentworkflow/aps/system/services/notifier/parse/WorkflowNotifierDOM.java @@ -30,6 +30,7 @@ import org.jdom2.CDATA; import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.XMLOutputter; @@ -135,7 +136,7 @@ protected Element prepareMailElement(NotifierConfig notifierConfig) { } protected Element getRootElement(String xmlText) throws ApsSystemException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); Element root = null; @@ -150,7 +151,7 @@ protected Element getRootElement(String xmlText) throws ApsSystemException { } protected Document decodeDOM(String xmlText) throws ApsSystemException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/contentworkflow-plugin/src/main/java/com/agiletec/plugins/jpcontentworkflow/aps/system/services/workflow/parse/ContentWorkflowDOM.java b/contentworkflow-plugin/src/main/java/com/agiletec/plugins/jpcontentworkflow/aps/system/services/workflow/parse/ContentWorkflowDOM.java index 48aa4952e4..ff92d641f3 100644 --- a/contentworkflow-plugin/src/main/java/com/agiletec/plugins/jpcontentworkflow/aps/system/services/workflow/parse/ContentWorkflowDOM.java +++ b/contentworkflow-plugin/src/main/java/com/agiletec/plugins/jpcontentworkflow/aps/system/services/workflow/parse/ContentWorkflowDOM.java @@ -31,6 +31,7 @@ import java.util.Map; import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -129,7 +130,7 @@ protected Element createStepElement(Step step) { } protected Element getRootElement(String xmlText) throws ApsSystemException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); Element root = null; diff --git a/engine/src/main/java/com/agiletec/aps/system/common/entity/parse/AbstractAttributeSupportObjectDOM.java b/engine/src/main/java/com/agiletec/aps/system/common/entity/parse/AbstractAttributeSupportObjectDOM.java index 2c19246f59..471f6c8cd3 100644 --- a/engine/src/main/java/com/agiletec/aps/system/common/entity/parse/AbstractAttributeSupportObjectDOM.java +++ b/engine/src/main/java/com/agiletec/aps/system/common/entity/parse/AbstractAttributeSupportObjectDOM.java @@ -73,7 +73,7 @@ protected void validate(String xmlText, String definitionPath) throws EntExcepti protected Document decodeDOM(String xmlText) throws EntException { Document doc = null; - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/engine/src/main/java/com/agiletec/aps/system/common/entity/parse/EntityTypeDOM.java b/engine/src/main/java/com/agiletec/aps/system/common/entity/parse/EntityTypeDOM.java index 6c9449e154..7d5c37691a 100644 --- a/engine/src/main/java/com/agiletec/aps/system/common/entity/parse/EntityTypeDOM.java +++ b/engine/src/main/java/com/agiletec/aps/system/common/entity/parse/EntityTypeDOM.java @@ -22,6 +22,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -183,7 +184,7 @@ protected Element createRootTypeElement(IApsEntity currentEntityType) { private Document decodeDOM(String xmlText) throws EntException { Document doc = null; - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/engine/src/main/java/com/agiletec/aps/system/services/baseconfig/SystemParamsUtils.java b/engine/src/main/java/com/agiletec/aps/system/services/baseconfig/SystemParamsUtils.java index 9749157633..030ec05bc9 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/baseconfig/SystemParamsUtils.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/baseconfig/SystemParamsUtils.java @@ -21,6 +21,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -148,7 +149,7 @@ private static Element searchParamElement(Element currentElement, String paramNa private static Document decodeDOM(String xmlText) throws EntException { Document doc = null; try { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); doc = builder.build(reader); diff --git a/engine/src/main/java/com/agiletec/aps/system/services/lang/LangDOM.java b/engine/src/main/java/com/agiletec/aps/system/services/lang/LangDOM.java index 26637a91d8..fbc5165a8e 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/lang/LangDOM.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/lang/LangDOM.java @@ -19,6 +19,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -127,7 +128,7 @@ public String getXMLDocument(){ } private void decodeDOM(String xmlText) throws EntException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/engine/src/main/java/com/agiletec/aps/system/services/page/PageExtraConfigDOM.java b/engine/src/main/java/com/agiletec/aps/system/services/page/PageExtraConfigDOM.java index e97b69da24..e81177eb51 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/page/PageExtraConfigDOM.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/page/PageExtraConfigDOM.java @@ -20,6 +20,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -112,7 +113,7 @@ protected void fillDocument(Document doc, PageMetadata page) { private Document decodeDOM(String xml) throws EntException { Document doc = null; - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xml); try { diff --git a/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelDOM.java b/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelDOM.java index 75c661f356..94a6f94076 100644 --- a/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelDOM.java +++ b/engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelDOM.java @@ -28,6 +28,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -107,13 +108,13 @@ private Element buildSketchXML(Frame frame) { } private void decodeDOM(String xmlText) throws EntException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { _doc = builder.build(reader); } catch (Throwable t) { - _logger.error("Error parsing the page template XML: {}", xmlText, t); + _logger.error("Error parsing the page template XML", t); throw new EntException("Error parsing the page template XML", t); } } diff --git a/engine/src/main/java/com/agiletec/aps/util/ApsPropertiesDOM.java b/engine/src/main/java/com/agiletec/aps/util/ApsPropertiesDOM.java index 9a336f205f..86def21359 100644 --- a/engine/src/main/java/com/agiletec/aps/util/ApsPropertiesDOM.java +++ b/engine/src/main/java/com/agiletec/aps/util/ApsPropertiesDOM.java @@ -20,6 +20,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -80,7 +81,7 @@ public Element getRootElement() { } private void decodeDOM(String xmlText) { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/engine/src/main/java/org/entando/entando/aps/system/init/model/DataSourceDumpReport.java b/engine/src/main/java/org/entando/entando/aps/system/init/model/DataSourceDumpReport.java index 84bfe9f6ed..b9b5f9479a 100644 --- a/engine/src/main/java/org/entando/entando/aps/system/init/model/DataSourceDumpReport.java +++ b/engine/src/main/java/org/entando/entando/aps/system/init/model/DataSourceDumpReport.java @@ -24,6 +24,7 @@ import org.apache.commons.beanutils.BeanComparator; import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -51,7 +52,7 @@ public DataSourceDumpReport(String xmlText) { if (null == xmlText || xmlText.trim().length() == 0) { return; } - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/engine/src/main/java/org/entando/entando/aps/system/init/model/SystemInstallationReport.java b/engine/src/main/java/org/entando/entando/aps/system/init/model/SystemInstallationReport.java index e5372d7a18..34ed85218e 100644 --- a/engine/src/main/java/org/entando/entando/aps/system/init/model/SystemInstallationReport.java +++ b/engine/src/main/java/org/entando/entando/aps/system/init/model/SystemInstallationReport.java @@ -20,6 +20,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -72,7 +73,7 @@ public SystemInstallationReport(String xmlText) { this.setStatus(Status.PORTING); return; } - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/engine/src/main/java/org/entando/entando/aps/system/init/util/ComponentDefDOM.java b/engine/src/main/java/org/entando/entando/aps/system/init/util/ComponentDefDOM.java index aeae6cbd72..3682189ad0 100644 --- a/engine/src/main/java/org/entando/entando/aps/system/init/util/ComponentDefDOM.java +++ b/engine/src/main/java/org/entando/entando/aps/system/init/util/ComponentDefDOM.java @@ -93,7 +93,7 @@ protected Component getComponent(Map postProcessClasses) { } private void decodeDOM(String xmlText) throws EntException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/engine/src/main/java/org/entando/entando/aps/system/services/api/ApiResourcesDefDOM.java b/engine/src/main/java/org/entando/entando/aps/system/services/api/ApiResourcesDefDOM.java index be7d6870fa..589eb28e3a 100644 --- a/engine/src/main/java/org/entando/entando/aps/system/services/api/ApiResourcesDefDOM.java +++ b/engine/src/main/java/org/entando/entando/aps/system/services/api/ApiResourcesDefDOM.java @@ -166,7 +166,7 @@ private void checkMethod(ApiMethod apiMethod, ApiResource resource) { } private void decodeDOM(String xmlText) throws EntException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/engine/src/main/java/org/entando/entando/aps/system/services/api/ServiceExtraConfigDOM.java b/engine/src/main/java/org/entando/entando/aps/system/services/api/ServiceExtraConfigDOM.java index 990c646c49..2da366c307 100644 --- a/engine/src/main/java/org/entando/entando/aps/system/services/api/ServiceExtraConfigDOM.java +++ b/engine/src/main/java/org/entando/entando/aps/system/services/api/ServiceExtraConfigDOM.java @@ -18,6 +18,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -62,7 +63,7 @@ protected String[] extractFreeParameters() { } private void decodeDOM(String xml) throws EntException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xml); try { diff --git a/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeDOM.java b/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeDOM.java index 3335c468ca..b784b251c3 100644 --- a/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeDOM.java +++ b/engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeDOM.java @@ -20,6 +20,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -142,7 +143,7 @@ public String getXMLDocument(){ } private void decodeDOM(String xmlText) throws EntException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/engine/src/main/java/org/entando/entando/ent/util/EntSafeXmlUtils.java b/engine/src/main/java/org/entando/entando/ent/util/EntSafeXmlUtils.java index b6d825ffcc..49cf4ef233 100644 --- a/engine/src/main/java/org/entando/entando/ent/util/EntSafeXmlUtils.java +++ b/engine/src/main/java/org/entando/entando/ent/util/EntSafeXmlUtils.java @@ -15,6 +15,7 @@ package org.entando.entando.ent.util; import org.entando.entando.ent.exception.EntRuntimeException; +import org.jdom2.input.SAXBuilder; import org.xml.sax.SAXException; import org.xml.sax.SAXNotRecognizedException; import org.xml.sax.SAXNotSupportedException; @@ -76,6 +77,16 @@ public static Schema newSafeSchema(String schemaLanguage, InputStream resourceAs return factory.newSchema(schemaSource); } + public static SAXBuilder newSafeSAXBuilder() { + SAXBuilder builder = new SAXBuilder(); + builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + builder.setFeature("http://xml.org/sax/features/external-general-entities", false); + builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + builder.setExpandEntities(false); + return builder; + } + private EntSafeXmlUtils() { } } diff --git a/mail-plugin/src/main/java/com/agiletec/plugins/jpmail/aps/services/mail/parse/MailConfigDOM.java b/mail-plugin/src/main/java/com/agiletec/plugins/jpmail/aps/services/mail/parse/MailConfigDOM.java index fe4246467e..4452b8d5ce 100644 --- a/mail-plugin/src/main/java/com/agiletec/plugins/jpmail/aps/services/mail/parse/MailConfigDOM.java +++ b/mail-plugin/src/main/java/com/agiletec/plugins/jpmail/aps/services/mail/parse/MailConfigDOM.java @@ -28,6 +28,7 @@ import org.jdom2.Document; import org.jdom2.Element; import org.jdom2.JDOMException; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.jdom2.output.Format; import org.jdom2.output.XMLOutputter; @@ -248,7 +249,7 @@ private Element createSmtpElement(MailConfig config) { * @throws EntException In case of parsing exceptions. */ private Element getRootElement(String xmlText) throws EntException { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); Element root = null; diff --git a/seo-plugin/src/main/java/org/entando/entando/plugins/jpseo/aps/system/services/metatag/MetatagDOM.java b/seo-plugin/src/main/java/org/entando/entando/plugins/jpseo/aps/system/services/metatag/MetatagDOM.java index c4512aed82..fc2f7eeabb 100644 --- a/seo-plugin/src/main/java/org/entando/entando/plugins/jpseo/aps/system/services/metatag/MetatagDOM.java +++ b/seo-plugin/src/main/java/org/entando/entando/plugins/jpseo/aps/system/services/metatag/MetatagDOM.java @@ -18,6 +18,7 @@ import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; @@ -56,7 +57,7 @@ public Map getMetatags() { } private void decodeDOM(String xmlText) { - SAXBuilder builder = new SAXBuilder(); + SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder(); builder.setValidation(false); StringReader reader = new StringReader(xmlText); try { diff --git a/seo-plugin/src/main/java/org/entando/entando/plugins/jpseo/aps/system/services/page/SeoPageExtraConfigDOM.java b/seo-plugin/src/main/java/org/entando/entando/plugins/jpseo/aps/system/services/page/SeoPageExtraConfigDOM.java index 9cd162dec5..aebeb4a736 100644 --- a/seo-plugin/src/main/java/org/entando/entando/plugins/jpseo/aps/system/services/page/SeoPageExtraConfigDOM.java +++ b/seo-plugin/src/main/java/org/entando/entando/plugins/jpseo/aps/system/services/page/SeoPageExtraConfigDOM.java @@ -34,6 +34,7 @@ import org.apache.commons.lang3.StringUtils; import org.jdom2.Document; import org.jdom2.Element; +import org.entando.entando.ent.util.EntSafeXmlUtils; import org.jdom2.input.SAXBuilder; import org.entando.entando.ent.util.EntLogging.EntLogger; import org.entando.entando.ent.util.EntLogging.EntLogFactory; @@ -175,7 +176,7 @@ protected Map> extractComplexParameters(List Date: Tue, 23 Jun 2026 14:40:40 +0200 Subject: [PATCH 2/4] ESB-1146 Explicitly disable Keycloak configuration to avoid triggering ERROR log level lines interpreted by the CI as a test failure (in this case, JNDI property missing) --- admin-console/src/test/config/conf/systemParams.properties | 4 ++++ cds-plugin/src/test/config/conf/systemParams.properties | 4 ++++ cms-plugin/src/test/config/conf/systemParams.properties | 4 ++++ .../src/test/config/conf/systemParams.properties | 4 ++++ .../src/test/config/conf/systemParams.properties | 4 ++++ engine/src/test/config/conf/systemParams.properties | 4 ++++ .../src/test/config/conf/systemParams.properties | 4 ++++ mail-plugin/src/test/config/conf/systemParams.properties | 4 ++++ portal-ui/src/test/config/conf/systemParams.properties | 4 ++++ redis-plugin/src/test/config/conf/systemParams.properties | 4 ++++ seo-plugin/src/test/config/conf/systemParams.properties | 4 ++++ solr-plugin/src/test/config/conf/systemParams.properties | 6 +++++- .../src/test/config/conf/systemParams.properties | 4 ++++ webapp/src/test/config/conf/systemParams.properties | 4 ++++ .../src/test/config/conf/systemParams.properties | 4 ++++ 15 files changed, 61 insertions(+), 1 deletion(-) diff --git a/admin-console/src/test/config/conf/systemParams.properties b/admin-console/src/test/config/conf/systemParams.properties index 7df79c76cc..e71ad1ea5b 100644 --- a/admin-console/src/test/config/conf/systemParams.properties +++ b/admin-console/src/test/config/conf/systemParams.properties @@ -81,3 +81,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/cds-plugin/src/test/config/conf/systemParams.properties b/cds-plugin/src/test/config/conf/systemParams.properties index c098c1783a..0958605a07 100644 --- a/cds-plugin/src/test/config/conf/systemParams.properties +++ b/cds-plugin/src/test/config/conf/systemParams.properties @@ -90,3 +90,7 @@ oauth2.refreshToken.validitySeconds=86400 cds.public.url=${CDS_PUBLIC_URL:https://cds.sme.entando.org} cds.private.url=${CDS_PRIVATE_URL:https://cds.sme.entando.org} cds.path=${CDS_PATH:/api/v1} + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/cms-plugin/src/test/config/conf/systemParams.properties b/cms-plugin/src/test/config/conf/systemParams.properties index 9c8a2c9daa..a33b594e36 100644 --- a/cms-plugin/src/test/config/conf/systemParams.properties +++ b/cms-plugin/src/test/config/conf/systemParams.properties @@ -83,3 +83,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/contentscheduler-plugin/src/test/config/conf/systemParams.properties b/contentscheduler-plugin/src/test/config/conf/systemParams.properties index 50931626d4..8ed14c73d0 100644 --- a/contentscheduler-plugin/src/test/config/conf/systemParams.properties +++ b/contentscheduler-plugin/src/test/config/conf/systemParams.properties @@ -83,3 +83,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/contentworkflow-plugin/src/test/config/conf/systemParams.properties b/contentworkflow-plugin/src/test/config/conf/systemParams.properties index 09e56b5616..b2a503b23a 100644 --- a/contentworkflow-plugin/src/test/config/conf/systemParams.properties +++ b/contentworkflow-plugin/src/test/config/conf/systemParams.properties @@ -78,3 +78,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/engine/src/test/config/conf/systemParams.properties b/engine/src/test/config/conf/systemParams.properties index df2280b77d..45cd1421d7 100644 --- a/engine/src/test/config/conf/systemParams.properties +++ b/engine/src/test/config/conf/systemParams.properties @@ -103,3 +103,7 @@ entando.liquibase.lock.fallback.minutes=5 # CSP Header configuration CSP_HEADER_ENABLED=false + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/keycloak-plugin/src/test/config/conf/systemParams.properties b/keycloak-plugin/src/test/config/conf/systemParams.properties index f6a35c579c..16161d06a4 100644 --- a/keycloak-plugin/src/test/config/conf/systemParams.properties +++ b/keycloak-plugin/src/test/config/conf/systemParams.properties @@ -81,3 +81,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/mail-plugin/src/test/config/conf/systemParams.properties b/mail-plugin/src/test/config/conf/systemParams.properties index eed002417a..5c0240a137 100644 --- a/mail-plugin/src/test/config/conf/systemParams.properties +++ b/mail-plugin/src/test/config/conf/systemParams.properties @@ -80,3 +80,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/portal-ui/src/test/config/conf/systemParams.properties b/portal-ui/src/test/config/conf/systemParams.properties index f6a35c579c..16161d06a4 100644 --- a/portal-ui/src/test/config/conf/systemParams.properties +++ b/portal-ui/src/test/config/conf/systemParams.properties @@ -81,3 +81,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/redis-plugin/src/test/config/conf/systemParams.properties b/redis-plugin/src/test/config/conf/systemParams.properties index 9c8a2c9daa..a33b594e36 100644 --- a/redis-plugin/src/test/config/conf/systemParams.properties +++ b/redis-plugin/src/test/config/conf/systemParams.properties @@ -83,3 +83,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/seo-plugin/src/test/config/conf/systemParams.properties b/seo-plugin/src/test/config/conf/systemParams.properties index 9c8a2c9daa..a33b594e36 100644 --- a/seo-plugin/src/test/config/conf/systemParams.properties +++ b/seo-plugin/src/test/config/conf/systemParams.properties @@ -83,3 +83,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/solr-plugin/src/test/config/conf/systemParams.properties b/solr-plugin/src/test/config/conf/systemParams.properties index de93b3f197..a93bdd2419 100644 --- a/solr-plugin/src/test/config/conf/systemParams.properties +++ b/solr-plugin/src/test/config/conf/systemParams.properties @@ -82,4 +82,8 @@ db.environment=test ## OAuth2 configuration oauth2.accessToken.validitySeconds=3600 -oauth2.refreshToken.validitySeconds=86400 \ No newline at end of file +oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false \ No newline at end of file diff --git a/versioning-plugin/src/test/config/conf/systemParams.properties b/versioning-plugin/src/test/config/conf/systemParams.properties index 68cc03797c..a6d5f64021 100644 --- a/versioning-plugin/src/test/config/conf/systemParams.properties +++ b/versioning-plugin/src/test/config/conf/systemParams.properties @@ -82,3 +82,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/webapp/src/test/config/conf/systemParams.properties b/webapp/src/test/config/conf/systemParams.properties index 14e4a01355..2df26e71aa 100644 --- a/webapp/src/test/config/conf/systemParams.properties +++ b/webapp/src/test/config/conf/systemParams.properties @@ -78,3 +78,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false diff --git a/webdynamicform-plugin/src/test/config/conf/systemParams.properties b/webdynamicform-plugin/src/test/config/conf/systemParams.properties index 9c8a2c9daa..a33b594e36 100644 --- a/webdynamicform-plugin/src/test/config/conf/systemParams.properties +++ b/webdynamicform-plugin/src/test/config/conf/systemParams.properties @@ -83,3 +83,7 @@ db.environment=test oauth2.accessToken.validitySeconds=3600 oauth2.refreshToken.validitySeconds=86400 + +##---------------------- +## Keycloak configuration +keycloak.enabled=false From 4835373108da74508412b029c90b313a790e2dc2 Mon Sep 17 00:00:00 2001 From: "Matteo E. Minnai" Date: Wed, 24 Jun 2026 10:03:55 +0200 Subject: [PATCH 3/4] ESB-1146 Fix redis test --- redis-plugin/docker-compose-sentinel.yaml | 9 +++++---- .../jpredis/utils/RedisSentinelTestExtension.java | 15 ++++++++++++--- 2 files changed, 17 insertions(+), 7 deletions(-) diff --git a/redis-plugin/docker-compose-sentinel.yaml b/redis-plugin/docker-compose-sentinel.yaml index d5309e8dee..647f4eeb4a 100644 --- a/redis-plugin/docker-compose-sentinel.yaml +++ b/redis-plugin/docker-compose-sentinel.yaml @@ -6,7 +6,7 @@ networks: services: redis: - image: 'bitnami/redis:latest' + image: 'bitnamilegacy/redis:7.0.8-debian-11-r12' environment: - REDIS_REPLICATION_MODE=master - REDIS_PASSWORD=str0ng_passw0rd @@ -15,7 +15,7 @@ services: ports: - '6379' redis-slave: - image: 'bitnami/redis:latest' + image: 'bitnamilegacy/redis:7.0.8-debian-11-r12' environment: - REDIS_REPLICATION_MODE=slave - REDIS_MASTER_HOST=redis @@ -28,13 +28,14 @@ services: networks: - app-tier redis-sentinel: - image: 'bitnami/redis-sentinel:latest' + image: 'bitnamilegacy/redis-sentinel:7.0.8-debian-11-r11' environment: - REDIS_MASTER_PASSWORD=str0ng_passw0rd + - ALLOW_EMPTY_PASSWORD=yes depends_on: - redis - redis-slave ports: - '26379' networks: - - app-tier \ No newline at end of file + - app-tier diff --git a/redis-plugin/src/test/java/org/entando/entando/plugins/jpredis/utils/RedisSentinelTestExtension.java b/redis-plugin/src/test/java/org/entando/entando/plugins/jpredis/utils/RedisSentinelTestExtension.java index 6a4cecdb1d..00d034693c 100644 --- a/redis-plugin/src/test/java/org/entando/entando/plugins/jpredis/utils/RedisSentinelTestExtension.java +++ b/redis-plugin/src/test/java/org/entando/entando/plugins/jpredis/utils/RedisSentinelTestExtension.java @@ -5,6 +5,7 @@ import java.lang.annotation.Retention; import java.lang.annotation.RetentionPolicy; import java.lang.annotation.Target; +import java.time.Duration; import java.util.Collections; import java.util.List; import org.entando.entando.aps.system.services.cache.RedisEnvironmentVariables; @@ -19,6 +20,7 @@ import org.opentest4j.TestAbortedException; import org.testcontainers.DockerClientFactory; import org.testcontainers.containers.DockerComposeContainer; +import org.testcontainers.containers.wait.strategy.Wait; public class RedisSentinelTestExtension implements BeforeAllCallback, AfterAllCallback, ParameterResolver { @@ -41,9 +43,16 @@ public void beforeAll(ExtensionContext extensionContext) throws Exception { } if (!composeStarted) { DockerComposeContainer container = new DockerComposeContainer(new File("docker-compose-sentinel.yaml")) - .withExposedService(REDIS_SERVICE, REDIS_PORT) - .withExposedService(REDIS_SLAVE_SERVICE, REDIS_PORT) - .withExposedService(REDIS_SENTINEL_SERVICE, REDIS_SENTINEL_PORT); + .withExposedService(REDIS_SERVICE, REDIS_PORT, + Wait.forLogMessage(".*Ready to accept connections.*", 1) + .withStartupTimeout(Duration.ofMinutes(1))) + .withExposedService(REDIS_SLAVE_SERVICE, REDIS_PORT, + Wait.forLogMessage(".*Ready to accept connections.*", 1) + .withStartupTimeout(Duration.ofMinutes(1))) + .withExposedService(REDIS_SENTINEL_SERVICE, REDIS_SENTINEL_PORT, + Wait.forLogMessage(".*Sentinel ID is.*", 1) + .withStartupTimeout(Duration.ofMinutes(1))); + container.start(); composeContainer = container; composeStarted = true; From 5ff7bffa759b674cf17ec64918448504060f426a Mon Sep 17 00:00:00 2001 From: "Matteo E. Minnai" Date: Wed, 24 Jun 2026 11:14:34 +0200 Subject: [PATCH 4/4] ESB-1146 quality gate --- .../org/entando/entando/ent/util/EntSafeXmlUtils.java | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/engine/src/main/java/org/entando/entando/ent/util/EntSafeXmlUtils.java b/engine/src/main/java/org/entando/entando/ent/util/EntSafeXmlUtils.java index 49cf4ef233..b53b6eb123 100644 --- a/engine/src/main/java/org/entando/entando/ent/util/EntSafeXmlUtils.java +++ b/engine/src/main/java/org/entando/entando/ent/util/EntSafeXmlUtils.java @@ -42,6 +42,7 @@ public class EntSafeXmlUtils { private static final String HTTP_XML_ORG_SAX_FEATURES_EXTERNAL_PARAMETER_ENTITIES = "http://xml.org/sax/features/external-parameter-entities"; private static final String HTTP_APACHE_ORG_XML_FEATURES_NONVALIDATING_LOAD_EXTERNAL_DTD = "http://apache.org/xml/features/nonvalidating/load-external-dtd"; public static final String XMLSCHEMA_FACTORY_CLASS = "com.sun.org.apache.xerces.internal.jaxp.validation.XMLSchemaFactory"; + public static final String HTTP_APACHE_ORG_XML_FEATURES_DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl"; private static SAXParserFactory newSaxParserFactory() { SAXParserFactory parseFactory = SAXParserFactory.newInstance(); @@ -79,10 +80,10 @@ public static Schema newSafeSchema(String schemaLanguage, InputStream resourceAs public static SAXBuilder newSafeSAXBuilder() { SAXBuilder builder = new SAXBuilder(); - builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - builder.setFeature("http://xml.org/sax/features/external-general-entities", false); - builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + builder.setFeature(HTTP_APACHE_ORG_XML_FEATURES_DISALLOW_DOCTYPE_DECL, true); + builder.setFeature(HTTP_XML_ORG_SAX_FEATURES_EXTERNAL_GENERAL_ENTITIES, false); + builder.setFeature(HTTP_XML_ORG_SAX_FEATURES_EXTERNAL_PARAMETER_ENTITIES, false); + builder.setFeature(HTTP_APACHE_ORG_XML_FEATURES_NONVALIDATING_LOAD_EXTERNAL_DTD, false); builder.setExpandEntities(false); return builder; }