You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Russole (via GitHub)" <gi...@apache.org> on 2026/03/19 22:49:32 UTC
[PR] HDDS-14857. Use XMLUtils.newSecure...Factory [ozone]
Russole opened a new pull request, #9951:
URL: https://github.com/apache/ozone/pull/9951
## What changes were proposed in this pull request?
* Replace XML factory instantiation with corresponding newSecure...Factory from `XMLUtils`.
* Update `TestNodeSchemaLoader` to reflect changes in XML parsing behavior
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-14857
## How was this patch tested?
- All CI checks passed
- https://github.com/Russole/ozone/actions/runs/23305660363
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14857. Use XMLUtils.newSecure...Factory [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #9951:
URL: https://github.com/apache/ozone/pull/9951#issuecomment-4097310033
Thanks @Russole for updating the patch. Sorry, I failed to mention that `XMLConstants` will become unused.
```
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/MessageUnmarshaller.java
31: Unused import - javax.xml.XMLConstants.
hadoop-hdds/config/src/main/java/org/apache/hadoop/hdds/conf/ConfigFileAppender.java
25: Unused import - javax.xml.XMLConstants.
hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/scm/net/NodeSchemaLoader.java
31: Unused import - javax.xml.XMLConstants.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14857. Use XMLUtils.newSecure...Factory [ozone]
Posted by "Russole (via GitHub)" <gi...@apache.org>.
Russole commented on PR #9951:
URL: https://github.com/apache/ozone/pull/9951#issuecomment-4097304937
Thanks @sarvekshayr and @adoroszlai for the review. I’ve updated the patch based on the comments.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14857. Use XMLUtils.newSecure...Factory [ozone]
Posted by "sarvekshayr (via GitHub)" <gi...@apache.org>.
sarvekshayr merged PR #9951:
URL: https://github.com/apache/ozone/pull/9951
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14857. Use XMLUtils.newSecure...Factory [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on code in PR #9951:
URL: https://github.com/apache/ozone/pull/9951#discussion_r2964315437
##########
hadoop-hdds/config/src/main/java/org/apache/hadoop/hdds/conf/ConfigFileAppender.java:
##########
@@ -48,7 +49,7 @@ public class ConfigFileAppender {
public ConfigFileAppender() {
try {
- DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+ DocumentBuilderFactory factory = XMLUtils.newSecureDocumentBuilderFactory();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
Review Comment:
`FEATURE_SECURE_PROCESSING` can be removed.
```suggestion
```
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/MessageUnmarshaller.java:
##########
@@ -51,7 +52,7 @@ public MessageUnmarshaller(Class<T> cls) {
try {
context = JAXBContext.newInstance(cls);
- saxParserFactory = SAXParserFactory.newInstance();
+ saxParserFactory = XMLUtils.newSecureSAXParserFactory();
saxParserFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
Review Comment:
```suggestion
```
##########
hadoop-hdds/config/pom.xml:
##########
@@ -26,6 +26,10 @@
<description>Apache Ozone Distributed Data Store Config Tools</description>
<dependencies>
+ <dependency>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-common</artifactId>
Review Comment:
> I’m concerned about adding `hadoop-common` as a dependency to `hadoop-hdds/config`. By pulling in `hadoop-common` just to use `XMLUtils` in `ConfigFileAppender.java`
>
> Can we look into an alternative?
Thanks @sarvekshayr for raising the concern. Since `XMLUtils` is annotated as `@InterfaceAudience.Private`, we may be better off by copying it to Ozone. We can do that as a follow-up, and add exclusions for transitive dependencies now.
```suggestion
<artifactId>hadoop-common</artifactId>
<exclusions>
<exclusion>
<groupId>*</groupId>
<artifactId>*</artifactId>
</exclusion>
</exclusions>
```
##########
hadoop-hdds/config/src/main/java/org/apache/hadoop/hdds/conf/ConfigFileAppender.java:
##########
@@ -113,7 +114,7 @@ private void addXmlElement(Element parentElement, String tagValue,
*/
public void write(Writer writer) {
try {
- TransformerFactory factory = TransformerFactory.newInstance();
+ TransformerFactory factory = XMLUtils.newSecureTransformerFactory();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
Review Comment:
`FEATURE_SECURE_PROCESSING` can be removed.
```suggestion
```
##########
hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/scm/net/NodeSchemaLoader.java:
##########
@@ -174,7 +175,7 @@ private NodeSchemaLoadResult loadSchema(InputStream inputStream) throws
ParserConfigurationException, SAXException, IOException {
LOG.info("Loading network topology layer schema file");
// Read and parse the schema file.
- DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+ DocumentBuilderFactory dbf = XMLUtils.newSecureDocumentBuilderFactory();
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
Review Comment:
```suggestion
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14857. Use XMLUtils.newSecure...Factory [ozone]
Posted by "sarvekshayr (via GitHub)" <gi...@apache.org>.
sarvekshayr commented on PR #9951:
URL: https://github.com/apache/ozone/pull/9951#issuecomment-4097763071
Thanks @Russole for the patch and @adoroszlai for the review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org