You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hop.apache.org by "bamaer (via GitHub)" <gi...@apache.org> on 2026/09/14 12:16:41 UTC

[I] [Task]: Disable external entity resolution by default in the XSD Validator transform and action (hop)

bamaer opened a new issue, #8367:
URL: https://github.com/apache/hop/issues/8367

   ### What needs to happen?
   
   XSD validation resolves external entities unless explicitly turned off. The
   default comes from `ALLOW_EXTERNAL_ENTITIES_FOR_XSD_VALIDATION_DEFAULT`, which
   is `"true"` in both places it is defined:
   
   - `transforms/xml/.../xsdvalidator/XsdValidatorMeta.java:62` (XSD Validator transform)
   - `actions/xml/.../xsdvalidator/XsdValidator.java:76` (XSD Validator action)
   
   Both have the hardened configuration already implemented — a secure
   `SchemaFactory`, `disallow-doctype-decl`, external general and parameter
   entities off, and a rejecting entity resolver (transform:
   `XsdValidator.java:137-168`, action: `XsdValidator.java:135-166`). In both it is
   gated behind the flag being false, so with the current default it never runs and
   the unsecured `SchemaFactory` is selected instead.
   
   The fix is therefore the default value, not the implementation: change both
   constants to `"false"`.
   
   ### Issue Priority
   
   Priority: 2
   
   ### Issue Component
   
   Component: Transforms


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Task]: Disable external entity resolution by default in the XSD Validator transform and action (hop)

Posted by "bamaer (via GitHub)" <gi...@apache.org>.
bamaer commented on issue #8367:
URL: https://github.com/apache/hop/issues/8367#issuecomment-5663745614

   .take-issue


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Task]: Disable external entity resolution by default in the XSD Validator transform and action (hop)

Posted by "bamaer (via GitHub)" <gi...@apache.org>.
bamaer closed issue #8367: [Task]: Disable external entity resolution by default in the XSD Validator transform and action
URL: https://github.com/apache/hop/issues/8367


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org