You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ant.apache.org by bo...@apache.org on 2023/08/20 18:41:53 UTC
[ant-ivy] branch master updated (6ac4f36c -> e00e9e0e)
This is an automated email from the ASF dual-hosted git repository.
bodewig pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/ant-ivy.git
from 6ac4f36c bump copyright line
new 2be17bc1 CVE-2022-46751 don't parse doctypes and access external entities by default
new 6c0560f9 update release notes with CVE-2022-46751
new e00e9e0e prepare for next development iteration
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
asciidoc/release-notes.adoc | 14 +-
asciidoc/settings.adoc | 2 +
asciidoc/systemproperties.adoc | 67 ++++
asciidoc/toc.json | 5 +
doap_Ivy.rdf | 7 +
ivy.xml | 2 +-
src/java/org/apache/ivy/ant/IvyArtifactReport.java | 9 +-
src/java/org/apache/ivy/ant/IvyReport.java | 5 +-
.../ivy/core/settings/XmlSettingsParser.java | 9 +-
.../org/apache/ivy/osgi/obr/xml/OBRXMLWriter.java | 11 +-
.../apache/ivy/plugins/parser/m2/PomReader.java | 3 +-
.../parser/xml/XmlModuleDescriptorParser.java | 69 +++-
.../apache/ivy/plugins/report/XmlReportParser.java | 7 +-
src/java/org/apache/ivy/util/XMLHelper.java | 446 +++++++++++++++++++--
.../org/apache/ivy/core/resolve/ResolveTest.java | 39 ++
version.properties | 6 +-
16 files changed, 619 insertions(+), 82 deletions(-)
create mode 100644 asciidoc/systemproperties.adoc
[ant-ivy] 01/03: CVE-2022-46751 don't parse doctypes and access external entities by default
Posted by bo...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
bodewig pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ant-ivy.git
commit 2be17bc18b0e1d4123007d579e43ba1a4b6fab3d
Author: Stefan Bodewig <bo...@apache.org>
AuthorDate: Sun Jan 22 17:30:23 2023 +0100
CVE-2022-46751 don't parse doctypes and access external entities by default
---
asciidoc/settings.adoc | 2 +
asciidoc/systemproperties.adoc | 67 ++++
asciidoc/toc.json | 5 +
src/java/org/apache/ivy/ant/IvyArtifactReport.java | 9 +-
src/java/org/apache/ivy/ant/IvyReport.java | 5 +-
.../ivy/core/settings/XmlSettingsParser.java | 9 +-
.../org/apache/ivy/osgi/obr/xml/OBRXMLWriter.java | 11 +-
.../apache/ivy/plugins/parser/m2/PomReader.java | 3 +-
.../parser/xml/XmlModuleDescriptorParser.java | 69 +++-
.../apache/ivy/plugins/report/XmlReportParser.java | 7 +-
src/java/org/apache/ivy/util/XMLHelper.java | 446 +++++++++++++++++++--
.../org/apache/ivy/core/resolve/ResolveTest.java | 39 ++
12 files changed, 605 insertions(+), 67 deletions(-)
diff --git a/asciidoc/settings.adoc b/asciidoc/settings.adoc
index c18c9a27..770794fc 100644
--- a/asciidoc/settings.adoc
+++ b/asciidoc/settings.adoc
@@ -23,6 +23,8 @@ In order to work as you want, Ivy sometimes needs some settings. Actually, Ivy c
Settings are specified through an XML file, usually called `ivysettings.xml`. To configure Ivy from Ant, you just have to use the link:use/settings{outfilesuffix}[settings] datatype with the path of your settings file.
+In addition certain link:systemproperties{outfilesuffix}[Java system properties] affect the XML parsing behavior of Ivy.
+
Here is an example of the settings file:
[source, xml]
diff --git a/asciidoc/systemproperties.adoc b/asciidoc/systemproperties.adoc
new file mode 100644
index 00000000..47592436
--- /dev/null
+++ b/asciidoc/systemproperties.adoc
@@ -0,0 +1,67 @@
+////
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ https://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+////
+
+= Java System Properties Affecting Ivy
+
+== XML Parser Settings
+
+Starting with Ivy 2.5.2 Ivy's XML parser can be controlled via the use
+of two newly introduced system properties.
+
+If you want to restore the default behavior of Ivy 2.5.1 and earlier
+you need to set `ivy.xml.allow-doctype-processing` to `true` and
+`ivy.xml.external-resources` to `ALL`.
+
+=== `ivy.xml.allow-doctype-processing`
+
+This system property accepts `true` or `false` as values. When set to
+`false` Ivy will not allow any processing of doctype declarations at
+all, while setting it to `true` enables it.
+
+The default is to allow doctype processing if and only if Ivy is
+parsing a Maven POM file.
+
+=== `ivy.xml.external-resources`
+
+This system property controls if external resources are read during
+doctype processing - and if so, where they can be loadad from. The
+value of this system property is only ever used if
+`ivy.xml.allow-doctype-processing` is not `false`.
+
+The accepted values are
+
+* `PROHIBIT` makes Ivy fail if any doctype tries to load an external
+ resource.
+* `IGNORE` makes Ivy ignore any external resource that the doctype
+ declaration wants to load.
+* `LOCAL_ONLY` allows external resources to be loaded via `file:` or
+ `jar:file` URIs only.
+* `ALL` allows external resources to be loaded from any URI.
+
+The default behavior is to not allow doctype processing at all, but if
+it is enabled the value `PROHIBIT` is assumed unless the property has
+been set explicitly.
+
+When reading Maven POMs a specific internal system id is recognized as
+resource and will be loaded from a resource shipping with the Ivy
+distribution in order to deal with invalid POM files accepted by
+Apache Maven - and the default value for this property is
+`IGNORE`in that case. See
+link:https://issues.apache.org/jira/browse/IVY-921[IVY-921] for
+details.
diff --git a/asciidoc/toc.json b/asciidoc/toc.json
index 2c8f1908..c6f6ec44 100644
--- a/asciidoc/toc.json
+++ b/asciidoc/toc.json
@@ -150,6 +150,11 @@
}
]
},
+ {
+ "id": "systemproperties",
+ "title": "System Properties",
+ "children": []
+ },
{
"id":"settings",
"title":"Settings Files",
diff --git a/src/java/org/apache/ivy/ant/IvyArtifactReport.java b/src/java/org/apache/ivy/ant/IvyArtifactReport.java
index 7e56348e..2e662658 100644
--- a/src/java/org/apache/ivy/ant/IvyArtifactReport.java
+++ b/src/java/org/apache/ivy/ant/IvyArtifactReport.java
@@ -28,8 +28,6 @@ import java.util.Set;
import javax.xml.transform.OutputKeys;
import javax.xml.transform.TransformerConfigurationException;
-import javax.xml.transform.TransformerFactoryConfigurationError;
-import javax.xml.transform.sax.SAXTransformerFactory;
import javax.xml.transform.sax.TransformerHandler;
import javax.xml.transform.stream.StreamResult;
@@ -43,6 +41,7 @@ import org.apache.ivy.core.resolve.IvyNode;
import org.apache.ivy.core.resolve.ResolveOptions;
import org.apache.ivy.core.resolve.ResolvedModuleRevision;
import org.apache.ivy.core.retrieve.RetrieveOptions;
+import org.apache.ivy.util.XMLHelper;
import org.apache.tools.ant.BuildException;
import org.apache.tools.ant.Project;
import org.xml.sax.SAXException;
@@ -170,10 +169,8 @@ public class IvyArtifactReport extends IvyPostResolveTask {
}
private TransformerHandler createTransformerHandler(FileOutputStream fileOutputStream)
- throws TransformerFactoryConfigurationError, TransformerConfigurationException {
- SAXTransformerFactory transformerFact = (SAXTransformerFactory) SAXTransformerFactory
- .newInstance();
- TransformerHandler saxHandler = transformerFact.newTransformerHandler();
+ throws TransformerConfigurationException {
+ TransformerHandler saxHandler = XMLHelper.getTransformerHandler();
saxHandler.getTransformer().setOutputProperty(OutputKeys.ENCODING, "UTF-8");
saxHandler.getTransformer().setOutputProperty(OutputKeys.INDENT, "yes");
saxHandler.setResult(new StreamResult(fileOutputStream));
diff --git a/src/java/org/apache/ivy/ant/IvyReport.java b/src/java/org/apache/ivy/ant/IvyReport.java
index 662fd325..c3ba3836 100644
--- a/src/java/org/apache/ivy/ant/IvyReport.java
+++ b/src/java/org/apache/ivy/ant/IvyReport.java
@@ -33,7 +33,6 @@ import javax.xml.transform.Source;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerConfigurationException;
import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
import javax.xml.transform.stream.StreamResult;
import javax.xml.transform.stream.StreamSource;
@@ -48,6 +47,7 @@ import org.apache.ivy.plugins.report.XmlReportOutputter;
import org.apache.ivy.plugins.report.XmlReportParser;
import org.apache.ivy.util.FileUtil;
import org.apache.ivy.util.Message;
+import org.apache.ivy.util.XMLHelper;
import org.apache.tools.ant.BuildException;
import org.apache.tools.ant.taskdefs.XSLTProcess;
import org.apache.tools.ant.util.JAXPUtils;
@@ -313,8 +313,7 @@ public class IvyReport extends IvyTask {
Source xsltSource = new StreamSource(xsltStream, JAXPUtils.getSystemId(style));
// create transformer
- TransformerFactory tFactory = TransformerFactory.newInstance();
- Transformer transformer = tFactory.newTransformer(xsltSource);
+ Transformer transformer = XMLHelper.getTransformer(xsltSource);
// add standard parameters
transformer.setParameter("confs", conf);
diff --git a/src/java/org/apache/ivy/core/settings/XmlSettingsParser.java b/src/java/org/apache/ivy/core/settings/XmlSettingsParser.java
index 0c743c9a..f791e699 100644
--- a/src/java/org/apache/ivy/core/settings/XmlSettingsParser.java
+++ b/src/java/org/apache/ivy/core/settings/XmlSettingsParser.java
@@ -32,8 +32,6 @@ import java.util.HashMap;
import java.util.List;
import java.util.Map;
-import javax.xml.parsers.SAXParserFactory;
-
import org.apache.ivy.core.IvyPatternHelper;
import org.apache.ivy.core.cache.RepositoryCacheManager;
import org.apache.ivy.core.module.status.StatusManager;
@@ -46,6 +44,7 @@ import org.apache.ivy.util.Checks;
import org.apache.ivy.util.Configurator;
import org.apache.ivy.util.FileResolver;
import org.apache.ivy.util.Message;
+import org.apache.ivy.util.XMLHelper;
import org.apache.ivy.util.url.CredentialsStore;
import org.apache.ivy.util.url.TimeoutConstrainedURLHandler;
import org.apache.ivy.util.url.URLHandlerRegistry;
@@ -151,10 +150,8 @@ public class XmlSettingsParser extends DefaultHandler {
@SuppressWarnings("deprecation")
private void doParse(URL settingsUrl) throws IOException, ParseException {
this.settings = settingsUrl;
- try (InputStream stream = URLHandlerRegistry.getDefault().openStream(settingsUrl)) {
- InputSource inSrc = new InputSource(stream);
- inSrc.setSystemId(settingsUrl.toExternalForm());
- SAXParserFactory.newInstance().newSAXParser().parse(settingsUrl.toExternalForm(), this);
+ try {
+ XMLHelper.parse(settingsUrl, null, this);
ivy.validate();
} catch (IOException e) {
throw e;
diff --git a/src/java/org/apache/ivy/osgi/obr/xml/OBRXMLWriter.java b/src/java/org/apache/ivy/osgi/obr/xml/OBRXMLWriter.java
index 41bf0760..fc5557f5 100644
--- a/src/java/org/apache/ivy/osgi/obr/xml/OBRXMLWriter.java
+++ b/src/java/org/apache/ivy/osgi/obr/xml/OBRXMLWriter.java
@@ -22,9 +22,7 @@ import java.text.ParseException;
import java.util.Set;
import javax.xml.transform.OutputKeys;
-import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerConfigurationException;
-import javax.xml.transform.sax.SAXTransformerFactory;
import javax.xml.transform.sax.TransformerHandler;
import javax.xml.transform.stream.StreamResult;
@@ -45,6 +43,7 @@ import org.apache.ivy.osgi.repo.ManifestAndLocation;
import org.apache.ivy.osgi.util.Version;
import org.apache.ivy.osgi.util.VersionRange;
import org.apache.ivy.util.Message;
+import org.apache.ivy.util.XMLHelper;
import org.xml.sax.ContentHandler;
import org.xml.sax.SAXException;
import org.xml.sax.helpers.AttributesImpl;
@@ -53,12 +52,10 @@ public class OBRXMLWriter {
public static ContentHandler newHandler(OutputStream out, String encoding, boolean indent)
throws TransformerConfigurationException {
- SAXTransformerFactory tf = (SAXTransformerFactory) SAXTransformerFactory.newInstance();
- TransformerHandler hd = tf.newTransformerHandler();
- Transformer serializer = tf.newTransformer();
+ TransformerHandler hd = XMLHelper.getTransformerHandler();
+ hd.getTransformer().setOutputProperty(OutputKeys.ENCODING, encoding);
+ hd.getTransformer().setOutputProperty(OutputKeys.INDENT, indent ? "yes" : "no");
StreamResult stream = new StreamResult(out);
- serializer.setOutputProperty(OutputKeys.ENCODING, encoding);
- serializer.setOutputProperty(OutputKeys.INDENT, indent ? "yes" : "no");
hd.setResult(stream);
return hd;
}
diff --git a/src/java/org/apache/ivy/plugins/parser/m2/PomReader.java b/src/java/org/apache/ivy/plugins/parser/m2/PomReader.java
index 88c9d70e..2bafc9b2 100644
--- a/src/java/org/apache/ivy/plugins/parser/m2/PomReader.java
+++ b/src/java/org/apache/ivy/plugins/parser/m2/PomReader.java
@@ -130,12 +130,13 @@ public class PomReader {
public InputSource resolveEntity(String publicId, String systemId)
throws SAXException, IOException {
if (systemId != null && systemId.endsWith("m2-entities.ent")) {
+ // IVY-921: return an InputSource for our local packaged m2-entities.ent file
return new InputSource(
PomReader.class.getResourceAsStream("m2-entities.ent"));
}
return null;
}
- });
+ }, true, XMLHelper.ExternalResources.IGNORE);
projectElement = pomDomDoc.getDocumentElement();
if (!PROJECT.equals(projectElement.getNodeName())
&& !MODEL.equals(projectElement.getNodeName())) {
diff --git a/src/java/org/apache/ivy/plugins/parser/xml/XmlModuleDescriptorParser.java b/src/java/org/apache/ivy/plugins/parser/xml/XmlModuleDescriptorParser.java
index 352cd7f3..532bcd2c 100644
--- a/src/java/org/apache/ivy/plugins/parser/xml/XmlModuleDescriptorParser.java
+++ b/src/java/org/apache/ivy/plugins/parser/xml/XmlModuleDescriptorParser.java
@@ -17,9 +17,13 @@
*/
package org.apache.ivy.plugins.parser.xml;
+import java.io.BufferedReader;
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.StringReader;
+import java.io.UnsupportedEncodingException;
import java.net.MalformedURLException;
import java.net.URI;
import java.net.URISyntaxException;
@@ -80,6 +84,7 @@ import org.apache.ivy.util.Message;
import org.apache.ivy.util.XMLHelper;
import org.apache.ivy.util.extendable.ExtendableItemHelper;
import org.xml.sax.Attributes;
+import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
import static org.apache.ivy.core.module.descriptor.Configuration.Visibility.getVisibility;
@@ -216,6 +221,8 @@ public class XmlModuleDescriptorParser extends AbstractModuleDescriptorParser {
protected static final List<String> ALLOWED_VERSIONS = Arrays.asList("1.0",
"1.1", "1.2", "1.3", "1.4", "2.0", "2.1", "2.2", "2.3", "2.4");
+ private static final String IVY_XSD_CONTENT;
+
/* how and what do we have to parse */
private ParserSettings settings;
@@ -248,6 +255,40 @@ public class XmlModuleDescriptorParser extends AbstractModuleDescriptorParser {
private Stack<ExtraInfoHolder> extraInfoStack = new Stack<>();
+ static {
+ String ivyXSDContent = null;
+ final InputStream is = Parser.class.getResourceAsStream("ivy.xsd");
+ if (is != null) {
+ final StringBuilder sb = new StringBuilder();
+ try {
+ try {
+ final BufferedReader reader = new BufferedReader(new InputStreamReader(is, "UTF-8"));
+ String line = null;
+ while ((line = reader.readLine()) != null) {
+ if (sb.length() != 0) {
+ sb.append("\n");
+ }
+ sb.append(line);
+ }
+ } catch (UnsupportedEncodingException e) {
+ // ignore
+ ivyXSDContent = null;
+ } catch (IOException e) {
+ // ignore
+ ivyXSDContent = null;
+ }
+ } finally {
+ try {
+ is.close();
+ } catch (Exception e) {
+ // ignore
+ }
+ }
+ ivyXSDContent = sb.length() == 0 ? null : sb.toString();
+ }
+ IVY_XSD_CONTENT = ivyXSDContent;
+ }
+
public Parser(ModuleDescriptorParser parser, ParserSettings ivySettings) {
super(parser);
settings = ivySettings;
@@ -268,10 +309,14 @@ public class XmlModuleDescriptorParser extends AbstractModuleDescriptorParser {
public void parse() throws ParseException {
try {
URL schemaURL = validate ? getSchemaURL() : null;
+ XMLHelper.ExternalResources e =
+ validate && System.getProperty(XMLHelper.EXTERNAL_RESOURCES) == null
+ ? XMLHelper.ExternalResources.IGNORE
+ : XMLHelper.ExternalResources.fromSystemProperty();
if (descriptorURL != null) {
- XMLHelper.parse(descriptorURL, schemaURL, this);
+ XMLHelper.parse(descriptorURL, schemaURL, this, null, e);
} else {
- XMLHelper.parse(descriptorInput, schemaURL, this, null);
+ XMLHelper.parse(descriptorInput, schemaURL, this, null, e);
}
checkConfigurations();
replaceConfigurationWildcards();
@@ -296,6 +341,26 @@ public class XmlModuleDescriptorParser extends AbstractModuleDescriptorParser {
}
}
+ @Override
+ public InputSource resolveEntity(final String publicId, final String systemId)
+ throws IOException, SAXException {
+ if (isApacheOrgIvyXSDSystemId(systemId) && IVY_XSD_CONTENT != null) {
+ // redirect the schema location to local file based ivy.xsd whose content
+ // we have already read and is available in-memory.
+ final InputSource source = new InputSource(new StringReader(IVY_XSD_CONTENT));
+ return source;
+ }
+ return super.resolveEntity(publicId, systemId);
+ }
+
+ private static boolean isApacheOrgIvyXSDSystemId(final String systemId) {
+ if (systemId == null) {
+ return false;
+ }
+ return systemId.equals("http://ant.apache.org/ivy/schemas/ivy.xsd")
+ || systemId.equals("https://ant.apache.org/ivy/schemas/ivy.xsd");
+ }
+
@Override
public void startElement(String uri, String localName, String qName, Attributes attributes)
throws SAXException {
diff --git a/src/java/org/apache/ivy/plugins/report/XmlReportParser.java b/src/java/org/apache/ivy/plugins/report/XmlReportParser.java
index b35c4833..e791cf09 100644
--- a/src/java/org/apache/ivy/plugins/report/XmlReportParser.java
+++ b/src/java/org/apache/ivy/plugins/report/XmlReportParser.java
@@ -27,9 +27,6 @@ import java.util.Map;
import java.util.SortedMap;
import java.util.TreeMap;
-import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
-
import org.apache.ivy.core.cache.ArtifactOrigin;
import org.apache.ivy.core.module.descriptor.Artifact;
import org.apache.ivy.core.module.descriptor.DefaultArtifact;
@@ -38,6 +35,7 @@ import org.apache.ivy.core.report.ArtifactDownloadReport;
import org.apache.ivy.core.report.DownloadStatus;
import org.apache.ivy.core.report.MetadataArtifactDownloadReport;
import org.apache.ivy.util.DateUtil;
+import org.apache.ivy.util.XMLHelper;
import org.apache.ivy.util.extendable.ExtendableItemHelper;
import org.xml.sax.Attributes;
import org.xml.sax.SAXException;
@@ -242,8 +240,7 @@ public class XmlReportParser {
}
public void parse() throws Exception {
- SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
- saxParser.parse(report, new XmlReportParserHandler());
+ XMLHelper.parse(report.toURI().toURL(), null, new XmlReportParserHandler());
}
private static boolean parseBoolean(String str) {
diff --git a/src/java/org/apache/ivy/util/XMLHelper.java b/src/java/org/apache/ivy/util/XMLHelper.java
index 57373687..e5bfa7be 100644
--- a/src/java/org/apache/ivy/util/XMLHelper.java
+++ b/src/java/org/apache/ivy/util/XMLHelper.java
@@ -19,6 +19,7 @@ package org.apache.ivy.util;
import java.io.IOException;
import java.io.InputStream;
+import java.io.StringReader;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URL;
@@ -28,13 +29,24 @@ import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.Source;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerConfigurationException;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.sax.SAXTransformerFactory;
+import javax.xml.transform.sax.TransformerHandler;
import org.apache.ivy.util.url.URLHandlerRegistry;
import org.w3c.dom.Document;
+import org.xml.sax.Attributes;
import org.xml.sax.EntityResolver;
import org.xml.sax.InputSource;
+import org.xml.sax.Locator;
import org.xml.sax.SAXException;
import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+import org.xml.sax.SAXParseException;
+import org.xml.sax.XMLReader;
import org.xml.sax.ext.LexicalHandler;
import org.xml.sax.helpers.DefaultHandler;
@@ -50,49 +62,38 @@ public abstract class XMLHelper {
static final String W3C_XML_SCHEMA = "http://www.w3.org/2001/XMLSchema";
- private static boolean canUseSchemaValidation = true;
+ private static final String XML_ACCESS_EXTERNAL_SCHEMA = "http://javax.xml.XMLConstants/property/accessExternalSchema";
+ private static final String XML_ACCESS_EXTERNAL_DTD = "http://javax.xml.XMLConstants/property/accessExternalDTD";
+ public static final String ALLOW_DOCTYPE_PROCESSING = "ivy.xml.allow-doctype-processing";
+ public static final String EXTERNAL_RESOURCES = "ivy.xml.external-resources";
- private static Boolean canDisableExternalDtds = null;
-
- private static SAXParser newSAXParser(URL schema, InputStream schemaStream,
- boolean loadExternalDtds) throws ParserConfigurationException, SAXException {
- SAXParserFactory parserFactory = SAXParserFactory.newInstance();
+ private static SAXParser newSAXParser(final URL schema, final InputStream schemaStream,
+ final boolean allowXmlDoctypeProcessing, final ExternalResources externalResources)
+ throws ParserConfigurationException, SAXException {
+ final SAXParserFactory parserFactory = SAXParserFactory.newInstance();
parserFactory.setNamespaceAware(true);
- parserFactory.setValidating(canUseSchemaValidation && (schema != null));
- if (!loadExternalDtds && canDisableExternalDtds(parserFactory)) {
- parserFactory.setFeature(XERCES_LOAD_EXTERNAL_DTD, false);
- }
- SAXParser parser = parserFactory.newSAXParser();
+ parserFactory.setValidating(schema != null);
+ configureSafeFeatures(parserFactory, allowXmlDoctypeProcessing, externalResources);
- if (canUseSchemaValidation && schema != null) {
+ SAXParser parser = parserFactory.newSAXParser();
+ if (schema != null) {
try {
parser.setProperty(JAXP_SCHEMA_LANGUAGE, W3C_XML_SCHEMA);
parser.setProperty(JAXP_SCHEMA_SOURCE, schemaStream);
} catch (SAXNotRecognizedException ex) {
Message.warn("problem while setting JAXP validating property on SAXParser... "
+ "XML validation will not be done", ex);
- canUseSchemaValidation = false;
parserFactory.setValidating(false);
parser = parserFactory.newSAXParser();
}
}
-
- parser.getXMLReader().setFeature(XML_NAMESPACE_PREFIXES, true);
+ final XMLReader reader = parser.getXMLReader();
+ reader.setFeature(XML_NAMESPACE_PREFIXES, true);
+ reader.setProperty(XML_ACCESS_EXTERNAL_SCHEMA, externalResources.getAllowedProtocols());
+ reader.setProperty(XML_ACCESS_EXTERNAL_DTD, externalResources.getAllowedProtocols());
return parser;
}
- private static boolean canDisableExternalDtds(SAXParserFactory parserFactory) {
- if (canDisableExternalDtds == null) {
- try {
- parserFactory.getFeature(XERCES_LOAD_EXTERNAL_DTD);
- canDisableExternalDtds = Boolean.TRUE;
- } catch (Exception ex) {
- canDisableExternalDtds = Boolean.FALSE;
- }
- }
- return canDisableExternalDtds;
- }
-
/**
* Convert an URL to a valid systemId according to RFC 2396.
*
@@ -116,36 +117,58 @@ public abstract class XMLHelper {
parse(xmlURL, schema, handler, null);
}
- @SuppressWarnings("deprecation")
public static void parse(URL xmlURL, URL schema, DefaultHandler handler, LexicalHandler lHandler)
throws SAXException, IOException, ParserConfigurationException {
+ parse(xmlURL, schema, handler, lHandler, ExternalResources.fromSystemProperty());
+ }
+
+ @SuppressWarnings("deprecation")
+ public static void parse(URL xmlURL, URL schema, DefaultHandler handler, LexicalHandler lHandler,
+ final ExternalResources externalResources)
+ throws SAXException, IOException, ParserConfigurationException {
try (InputStream xmlStream = URLHandlerRegistry.getDefault().openStream(xmlURL)) {
InputSource inSrc = new InputSource(xmlStream);
inSrc.setSystemId(toSystemId(xmlURL));
- parse(inSrc, schema, handler, lHandler);
+ parse(inSrc, schema, handler, lHandler, externalResources);
}
}
public static void parse(InputStream xmlStream, URL schema, DefaultHandler handler,
LexicalHandler lHandler) throws SAXException, IOException, ParserConfigurationException {
+ parse(xmlStream, schema, handler, lHandler, ExternalResources.fromSystemProperty());
+ }
+
+ public static void parse(InputStream xmlStream, URL schema, DefaultHandler handler,
+ LexicalHandler lHandler, final ExternalResources externalResources)
+ throws SAXException, IOException, ParserConfigurationException {
parse(new InputSource(xmlStream), schema, handler, lHandler);
}
public static void parse(InputSource xmlStream, URL schema, DefaultHandler handler,
LexicalHandler lHandler) throws SAXException, IOException, ParserConfigurationException {
- parse(xmlStream, schema, handler, lHandler, true);
+ parse(xmlStream, schema, handler, lHandler, ExternalResources.fromSystemProperty());
+ }
+
+ public static void parse(final InputSource xmlStream, final URL schema,
+ final DefaultHandler handler, final LexicalHandler lHandler,
+ final boolean loadExternalDtds) throws SAXException, IOException,
+ ParserConfigurationException {
+ parse(xmlStream, schema, handler, lHandler,
+ loadExternalDtds ? ExternalResources.LOCAL_ONLY : ExternalResources.PROHIBIT);
}
@SuppressWarnings("deprecation")
- public static void parse(InputSource xmlStream, URL schema, DefaultHandler handler,
- LexicalHandler lHandler, boolean loadExternalDtds) throws SAXException, IOException,
+ public static void parse(final InputSource xmlStream, final URL schema,
+ final DefaultHandler handler, final LexicalHandler lHandler,
+ final ExternalResources externalResources) throws SAXException, IOException,
ParserConfigurationException {
InputStream schemaStream = null;
try {
if (schema != null) {
schemaStream = URLHandlerRegistry.getDefault().openStream(schema);
}
- SAXParser parser = XMLHelper.newSAXParser(schema, schemaStream, loadExternalDtds);
+ SAXParser parser = XMLHelper.newSAXParser(schema, schemaStream,
+ isXmlDoctypeProcessingAllowed(), externalResources);
if (lHandler != null) {
try {
@@ -157,7 +180,10 @@ public abstract class XMLHelper {
}
}
- parser.parse(xmlStream, handler);
+ DefaultHandler h = externalResources == ExternalResources.IGNORE
+ ? new NoopEntityResolverDefaultHandler(handler)
+ : handler;
+ parser.parse(xmlStream, h);
} finally {
if (schemaStream != null) {
try {
@@ -170,7 +196,7 @@ public abstract class XMLHelper {
}
public static boolean canUseSchemaValidation() {
- return canUseSchemaValidation;
+ return true;
}
/**
@@ -216,15 +242,33 @@ public abstract class XMLHelper {
public static Document parseToDom(InputSource source, EntityResolver entityResolver)
throws IOException, SAXException {
- DocumentBuilder docBuilder = getDocBuilder(entityResolver);
+ return parseToDom(source, entityResolver, isXmlDoctypeProcessingAllowed(),
+ ExternalResources.fromSystemProperty());
+ }
+
+ public static Document parseToDom(InputSource source, EntityResolver entityResolver,
+ boolean allowXmlDoctypeProcessing, ExternalResources externalResources)
+ throws IOException, SAXException {
+ DocumentBuilder docBuilder = getDocBuilder(entityResolver, allowXmlDoctypeProcessing,
+ externalResources);
return docBuilder.parse(source);
}
public static DocumentBuilder getDocBuilder(EntityResolver entityResolver) {
+ return getDocBuilder(entityResolver, isXmlDoctypeProcessingAllowed(),
+ ExternalResources.fromSystemProperty());
+ }
+
+ public static DocumentBuilder getDocBuilder(EntityResolver entityResolver,
+ boolean allowXmlDoctypeProcessing, ExternalResources externalResources) {
try {
- DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+ final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setValidating(false);
+ configureSafeFeatures(factory, allowXmlDoctypeProcessing, externalResources);
DocumentBuilder docBuilder = factory.newDocumentBuilder();
+ if (externalResources == ExternalResources.IGNORE) {
+ entityResolver = new NoopEntityResolver(entityResolver);
+ }
if (entityResolver != null) {
docBuilder.setEntityResolver(entityResolver);
}
@@ -234,7 +278,335 @@ public abstract class XMLHelper {
}
}
+ public static Transformer getTransformer(Source source) throws TransformerConfigurationException {
+ TransformerFactory factory = getTransformerFactory();
+ return factory.newTransformer(source);
+ }
+
+ public static TransformerHandler getTransformerHandler() throws TransformerConfigurationException {
+ SAXTransformerFactory factory = getTransformerFactory();
+ return factory.newTransformerHandler();
+ }
+
+ public enum ExternalResources {
+ PROHIBIT(""),
+ // technically the URIs for IGNORE will never get resolved at all.
+ // "all" pacifies some version of Java that check the property before delegating to the EntityResolver (which is
+ // going to return an empty content anyway)
+ IGNORE("all"),
+ LOCAL_ONLY("file, jar:file"),
+ ALL("all");
+
+ private final String allowedProtocols;
+
+ private ExternalResources(String allowedProtocols) {
+ this.allowedProtocols = allowedProtocols;
+ }
+
+ private String getAllowedProtocols() {
+ return allowedProtocols;
+ }
+
+ public static ExternalResources fromSystemProperty() {
+ final String val = System.getProperty(EXTERNAL_RESOURCES);
+ if (val != null) {
+ if (val.equalsIgnoreCase("ignore")) {
+ return IGNORE;
+ }
+ if (val.equalsIgnoreCase("all")) {
+ return ALL;
+ }
+ if (val.equalsIgnoreCase("local-only") || val.equalsIgnoreCase("local_only")) {
+ return LOCAL_ONLY;
+ }
+ }
+ return PROHIBIT;
+ }
+ }
+
+ public static boolean isXmlDoctypeProcessingAllowed() {
+ return "true".equals(System.getProperty(ALLOW_DOCTYPE_PROCESSING));
+ }
+
private XMLHelper() {
}
+ private static SAXTransformerFactory getTransformerFactory() {
+ TransformerFactory factory = SAXTransformerFactory.newInstance();
+ configureSafeFeatures(factory);
+ return (SAXTransformerFactory) factory;
+ }
+
+ private static void configureSafeFeatures(final DocumentBuilderFactory factory,
+ final boolean allowXmlDoctypeProcessing, final ExternalResources externalResources) {
+ final String DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";
+ trySetFeature(factory, DISALLOW_DOCTYPE_DECL, !allowXmlDoctypeProcessing);
+
+ // available since Java 6, as XMLConstants.FEATURE_SECURE_PROCESSING. We can't use Java 6
+ // at compile time, in current version, so inline the constant here
+ final String FEATURE_SECURE_PROCESSING = "http://javax.xml.XMLConstants/feature/secure-processing";
+ trySetFeature(factory, FEATURE_SECURE_PROCESSING, true);
+
+ final String ALLOW_EXTERNAL_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities";
+ trySetFeature(factory, ALLOW_EXTERNAL_GENERAL_ENTITIES, false);
+
+ final String ALLOW_EXTERNAL_PARAM_ENTITIES = "http://xml.org/sax/features/external-parameter-entities";
+ trySetFeature(factory, ALLOW_EXTERNAL_PARAM_ENTITIES, false);
+
+ final String LOAD_EXTERNAL_DTD = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
+ trySetFeature(factory, LOAD_EXTERNAL_DTD, externalResources != ExternalResources.PROHIBIT);
+
+ try {
+ factory.setXIncludeAware(false);
+ } catch (Exception e) {
+ // ignore
+ }
+ try {
+ factory.setExpandEntityReferences(false);
+ } catch (Exception e) {
+ // ignore
+ }
+ }
+
+ private static void configureSafeFeatures(final SAXParserFactory factory,
+ final boolean allowXmlDoctypeProcessing, final ExternalResources externalResources) {
+ final String DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";
+ trySetFeature(factory, DISALLOW_DOCTYPE_DECL, !allowXmlDoctypeProcessing);
+
+ // available since Java 6, as XMLConstants.FEATURE_SECURE_PROCESSING. We can't use Java 6
+ // at compile time, in current version, so inline the constant here
+ final String FEATURE_SECURE_PROCESSING = "http://javax.xml.XMLConstants/feature/secure-processing";
+ trySetFeature(factory, FEATURE_SECURE_PROCESSING, true);
+
+ final boolean allowEntities = externalResources == ExternalResources.LOCAL_ONLY
+ || externalResources == ExternalResources.ALL;
+ final String ALLOW_EXTERNAL_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities";
+ trySetFeature(factory, ALLOW_EXTERNAL_GENERAL_ENTITIES, allowEntities);
+
+ final String ALLOW_EXTERNAL_PARAM_ENTITIES = "http://xml.org/sax/features/external-parameter-entities";
+ trySetFeature(factory, ALLOW_EXTERNAL_PARAM_ENTITIES, allowEntities);
+ final String LOAD_EXTERNAL_DTD = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
+ trySetFeature(factory, LOAD_EXTERNAL_DTD, externalResources != ExternalResources.PROHIBIT);
+ try {
+ factory.setXIncludeAware(false);
+ } catch (Exception e) {
+ // ignore
+ }
+ }
+
+ private static void configureSafeFeatures(final TransformerFactory factory) {
+ // available since Java 7, as XMLConstants.ACCESS_EXTERNAL_DTD, ACCESS_EXTERNAL_SCHEMA and
+ // ACCESS_EXTERNAL_STYLESHEET respectively.
+ // We can't use Java 7 at compile time, in current version, so inline the constants here
+ trySetAttribute(factory, XML_ACCESS_EXTERNAL_DTD, "");
+ trySetAttribute(factory, XML_ACCESS_EXTERNAL_SCHEMA, "");
+ trySetAttribute(factory, "http://javax.xml.XMLConstants/property/accessExternalStylesheet", "");
+ }
+
+ private static boolean isFeatureSupported(final SAXParserFactory factory, final String feature) {
+ try {
+ factory.getFeature(feature);
+ return true;
+ } catch (ParserConfigurationException e) {
+ return false;
+ } catch (SAXNotRecognizedException e) {
+ return false;
+ } catch (SAXNotSupportedException e) {
+ return false;
+ }
+ }
+
+ private static boolean isFeatureSupported(final DocumentBuilderFactory factory, final String feature) {
+ try {
+ factory.getFeature(feature);
+ return true;
+ } catch (ParserConfigurationException e) {
+ return false;
+ }
+ }
+
+ private static boolean isAttributeSupported(final TransformerFactory factory, final String attribute) {
+ try {
+ factory.getAttribute(attribute);
+ return true;
+ } catch (IllegalArgumentException e) {
+ return false;
+ }
+ }
+
+ private static boolean trySetFeature(final DocumentBuilderFactory factory,
+ final String feature, final boolean val) {
+ if (!isFeatureSupported(factory, feature)) {
+ return false;
+ }
+ try {
+ factory.setFeature(feature, val);
+ return true;
+ } catch (ParserConfigurationException e) {
+ // log and continue
+ Message.warn("Failed to set feature " + feature + " on DocumentBuilderFactory", e);
+ return false;
+ }
+ }
+
+ private static boolean trySetFeature(final SAXParserFactory factory,
+ final String feature, final boolean val) {
+ if (!isFeatureSupported(factory, feature)) {
+ return false;
+ }
+ try {
+ factory.setFeature(feature, val);
+ return true;
+ } catch (ParserConfigurationException e) {
+ // log and continue
+ Message.warn("Failed to set feature " + feature + " on SAXParserFactory", e);
+ return false;
+ } catch (SAXNotRecognizedException e) {
+ // log and continue
+ Message.warn("Failed to set feature " + feature + " on SAXParserFactory", e);
+ return false;
+ } catch (SAXNotSupportedException e) {
+ // log and continue
+ Message.warn("Failed to set feature " + feature + " on SAXParserFactory", e);
+ return false;
+ }
+ }
+
+ private static boolean trySetAttribute(final TransformerFactory factory,
+ final String attribute, final String val) {
+ if (!isAttributeSupported(factory, attribute)) {
+ return false;
+ }
+ try {
+ factory.setAttribute(attribute, val);
+ return true;
+ } catch (IllegalArgumentException e) {
+ // log and continue
+ Message.warn("Failed to set attribute " + attribute + " on TransformerFactory", e);
+ return false;
+ }
+ }
+
+ private static final InputSource EMPTY_INPUT_SOURCE = new InputSource(new StringReader(""));
+
+ private static class NoopEntityResolver implements EntityResolver {
+ private EntityResolver wrapped;
+
+ private NoopEntityResolver(EntityResolver wrapped) {
+ this.wrapped = wrapped;
+ }
+
+ @Override
+ public InputSource resolveEntity(String publicId, String systemId) throws SAXException, IOException {
+ if (wrapped != null) {
+ InputSource s = wrapped.resolveEntity(publicId, systemId);
+ if (s != null) {
+ return s;
+ }
+ }
+ return EMPTY_INPUT_SOURCE;
+ }
+ }
+
+ private static class NoopEntityResolverDefaultHandler extends DefaultHandler {
+
+ private DefaultHandler wrapped;
+
+ private NoopEntityResolverDefaultHandler(DefaultHandler wrapped) {
+ this.wrapped = wrapped;
+ }
+
+ @Override
+ public InputSource resolveEntity(String publicId, String systemId) throws SAXException, IOException {
+ if (wrapped != null) {
+ InputSource s = wrapped.resolveEntity(publicId, systemId);
+ if (s != null) {
+ return s;
+ }
+ }
+ return EMPTY_INPUT_SOURCE;
+ }
+
+ @Override
+ public void notationDecl(String name, String publicId, String systemId) throws SAXException {
+ wrapped.notationDecl(name, publicId, systemId);
+ }
+
+ @Override
+ public void unparsedEntityDecl(String name, String publicId, String systemId, String notationName)
+ throws SAXException {
+ wrapped.unparsedEntityDecl(name, publicId, systemId, notationName);
+ }
+
+ @Override
+ public void setDocumentLocator(Locator locator) {
+ wrapped.setDocumentLocator(locator);
+ }
+
+ @Override
+ public void startDocument() throws SAXException {
+ wrapped.startDocument();
+ }
+
+ @Override
+ public void endDocument() throws SAXException {
+ wrapped.endDocument();
+ }
+
+ @Override
+ public void startPrefixMapping(String prefix, String uri) throws SAXException {
+ wrapped.startPrefixMapping(prefix, uri);
+ }
+
+ @Override
+ public void endPrefixMapping(String prefix) throws SAXException {
+ wrapped.endPrefixMapping(prefix);
+ }
+
+ @Override
+ public void startElement(String uri, String localName, String qName, Attributes attributes)
+ throws SAXException {
+ wrapped.startElement(uri, localName, qName, attributes);
+ }
+
+ @Override
+ public void endElement(String uri, String localName, String qName) throws SAXException {
+ wrapped.endElement(uri, localName, qName);
+ }
+
+ @Override
+ public void characters(char[] ch, int start, int length) throws SAXException {
+ wrapped.characters(ch, start, length);
+ }
+
+ @Override
+ public void ignorableWhitespace(char[] ch, int start, int length) throws SAXException {
+ wrapped.ignorableWhitespace(ch, start, length);
+ }
+
+ @Override
+ public void processingInstruction(String target, String data) throws SAXException {
+ wrapped.processingInstruction(target, data);
+ }
+
+ @Override
+ public void skippedEntity(String name) throws SAXException {
+ wrapped.skippedEntity(name);
+ }
+
+ @Override
+ public void warning(SAXParseException e) throws SAXException {
+ wrapped.warning(e);
+ }
+
+ @Override
+ public void error(SAXParseException e) throws SAXException {
+ wrapped.error(e);
+ }
+
+ @Override
+ public void fatalError(SAXParseException e) throws SAXException {
+ wrapped.fatalError(e);
+ }
+ }
}
diff --git a/test/java/org/apache/ivy/core/resolve/ResolveTest.java b/test/java/org/apache/ivy/core/resolve/ResolveTest.java
index 633ca646..5c611420 100644
--- a/test/java/org/apache/ivy/core/resolve/ResolveTest.java
+++ b/test/java/org/apache/ivy/core/resolve/ResolveTest.java
@@ -51,6 +51,7 @@ import org.apache.ivy.plugins.resolver.FileSystemResolver;
import org.apache.ivy.util.CacheCleaner;
import org.apache.ivy.util.FileUtil;
import org.apache.ivy.util.MockMessageLogger;
+import org.apache.ivy.util.XMLHelper;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
@@ -74,6 +75,7 @@ import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
+import java.util.Properties;
import java.util.Set;
import java.util.jar.JarEntry;
import java.util.jar.JarFile;
@@ -309,20 +311,57 @@ public class ResolveTest {
@Test
public void testResolveWithXmlEntities() {
+ testResolveWithXmlEntities(null, 0);
+ testResolveWithXmlEntities("prohibit", 0);
+ testResolveWithXmlEntities("ignore", 0);
+ testResolveWithXmlEntities("local-only", 2);
+ testResolveWithXmlEntities("LOCAL_ONLY", 2);
+ testResolveWithXmlEntities("all", 2);
+ }
+
+ private void testResolveWithXmlEntities(String externalResourcesSystemProperty,
+ int expectedNumberOfDependencies) {
Ivy ivy = new Ivy();
Throwable th = null;
+ Properties p = System.getProperties();
try {
+ System.setProperties(new Properties());
+ System.setProperty(XMLHelper.ALLOW_DOCTYPE_PROCESSING, "true");
+ if (externalResourcesSystemProperty != null) {
+ System.setProperty(XMLHelper.EXTERNAL_RESOURCES, externalResourcesSystemProperty);
+ }
ivy.configure(new File("test/repositories/xml-entities/ivysettings.xml"));
ResolveReport report = ivy.resolve(new File("test/repositories/xml-entities/ivy.xml"),
getResolveOptions(new String[] {"*"}));
assertNotNull(report);
assertFalse(report.hasError());
+ assertNotNull(report.getDependencies());
+ assertEquals("number of dependencies while setting " + externalResourcesSystemProperty,
+ expectedNumberOfDependencies, report.getDependencies().size());
} catch (Throwable e) {
th = e;
+ } finally {
+ System.setProperties(p);
}
assertNull(th);
}
+ @Test
+ public void testResolveWithXmlEntitiesButNoSystemProperty() {
+ Ivy ivy = new Ivy();
+ Throwable th = null;
+ try {
+ ivy.configure(new File("test/repositories/xml-entities/ivysettings.xml"));
+ ResolveReport report = ivy.resolve(new File("test/repositories/xml-entities/ivy.xml"),
+ getResolveOptions(new String[] {"*"}));
+ assertNotNull(report);
+ assertFalse(report.hasError());
+ } catch (Throwable e) {
+ th = e;
+ }
+ assertNotNull(th);
+ }
+
@Test
public void testResolveNoRevisionInPattern() throws Exception {
// module1 depends on latest version of module2, for which there is no revision in the
[ant-ivy] 02/03: update release notes with CVE-2022-46751
Posted by bo...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
bodewig pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ant-ivy.git
commit 6c0560f93ca421bc5ce210010b3c5f0bff01f2d9
Author: Stefan Bodewig <bo...@apache.org>
AuthorDate: Sun Aug 20 11:59:44 2023 +0200
update release notes with CVE-2022-46751
---
asciidoc/release-notes.adoc | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/asciidoc/release-notes.adoc b/asciidoc/release-notes.adoc
index 9f34ae99..653fa9ae 100644
--- a/asciidoc/release-notes.adoc
+++ b/asciidoc/release-notes.adoc
@@ -19,7 +19,7 @@
= Ivy Release Announcement
-XXXX Date XXXX - The Apache Ivy project is pleased to announce its 2.5.2 release.
+August 20 2023 - The Apache Ivy project is pleased to announce its 2.5.2 release.
== What is Ivy?
Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies, characterized by flexibility,
@@ -38,6 +38,7 @@ Key features of this 2.5.2 release are:
- FIX: reading POMs may loose dependencies when multiple Maven
dependencies only differ in `classifier` (jira:IVY-1642[])
+- Fixes a Security Vulnerability, see link:https://ant.apache.org/ivy/security.html[the scurity page] for details.
== List of Changes in this Release
@@ -57,6 +58,7 @@ For details about the following changes, check our JIRA install at link:https://
- FIX: reading POMs may loose dependencies when multiple Maven
dependencies only differ in `classifier` (jira:IVY-1642[])
- IMPROVEMENT: Upgrade Apache HttpClient to 4.5.13 (jira:IVY-1644[])
+- FIX: CVE-2022-46751: Apache Ivy Is Vulnerable to XML External Entity Injections
== Committers and Contributors
[ant-ivy] 03/03: prepare for next development iteration
Posted by bo...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
bodewig pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ant-ivy.git
commit e00e9e0ee072baf26e018ed27f30e23adf1c9953
Author: Stefan Bodewig <bo...@apache.org>
AuthorDate: Sun Aug 20 13:06:15 2023 +0200
prepare for next development iteration
---
asciidoc/release-notes.adoc | 16 +++-------------
doap_Ivy.rdf | 7 +++++++
ivy.xml | 2 +-
version.properties | 6 +++---
4 files changed, 14 insertions(+), 17 deletions(-)
diff --git a/asciidoc/release-notes.adoc b/asciidoc/release-notes.adoc
index 653fa9ae..7de155a1 100644
--- a/asciidoc/release-notes.adoc
+++ b/asciidoc/release-notes.adoc
@@ -19,7 +19,7 @@
= Ivy Release Announcement
-August 20 2023 - The Apache Ivy project is pleased to announce its 2.5.2 release.
+XXXX Date XXXX - The Apache Ivy project is pleased to announce its 2.6.0 release.
== What is Ivy?
Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies, characterized by flexibility,
@@ -34,17 +34,13 @@ More information about the project can be found on the website link:https://ant.
== Key features in this release
-Key features of this 2.5.2 release are:
-
-- FIX: reading POMs may loose dependencies when multiple Maven
- dependencies only differ in `classifier` (jira:IVY-1642[])
-- Fixes a Security Vulnerability, see link:https://ant.apache.org/ivy/security.html[the scurity page] for details.
+Key features of this 2.6.0 release are:
== List of Changes in this Release
For details about the following changes, check our JIRA install at link:https://issues.apache.org/jira/browse/IVY[]
-*List of changes since Ivy 2.5.1:*
+*List of changes since Ivy 2.5.2:*
////
Samples :
@@ -54,12 +50,6 @@ For details about the following changes, check our JIRA install at link:https://
- DOCUMENTATION: bla bla bla (jira:IVY-1234[]) (Thanks to Jane Doe)
////
-- FIX: ivy:retrieve could fail because of a `NullPointerException` (jira:IVY-1641[])
-- FIX: reading POMs may loose dependencies when multiple Maven
- dependencies only differ in `classifier` (jira:IVY-1642[])
-- IMPROVEMENT: Upgrade Apache HttpClient to 4.5.13 (jira:IVY-1644[])
-- FIX: CVE-2022-46751: Apache Ivy Is Vulnerable to XML External Entity Injections
-
== Committers and Contributors
Here is the list of people who have contributed source code and documentation up to this release. Many thanks to all of them, and also to the whole IvyDE community contributing ideas and feedback, and promoting the use of Apache Ivy !
diff --git a/doap_Ivy.rdf b/doap_Ivy.rdf
index 21a5de39..2fe7b5f0 100644
--- a/doap_Ivy.rdf
+++ b/doap_Ivy.rdf
@@ -34,6 +34,13 @@
<download-page rdf:resource="http://ant.apache.org/ivy/download.cgi" />
<programming-language>Java</programming-language>
<category rdf:resource="http://projects.apache.org/category/build-management" />
+ <release>
+ <Version>
+ <name>Apache Ivy 2.5.2</name>
+ <created>2023-08-20</created>
+ <revision>2.5.2</revision>
+ </Version>
+ </release>
<release>
<Version>
<name>Apache Ivy 2.5.1</name>
diff --git a/ivy.xml b/ivy.xml
index 47a21578..c3dac27e 100644
--- a/ivy.xml
+++ b/ivy.xml
@@ -21,7 +21,7 @@
xsi:noNamespaceSchemaLocation="http://ant.apache.org/ivy/schemas/ivy.xsd">
<info organisation="org.apache.ivy"
module="ivy"
- status="release">
+ status="integration">
<description homepage="http://ant.apache.org/ivy/">
Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies.
</description>
diff --git a/version.properties b/version.properties
index f90a3e3b..57a04932 100644
--- a/version.properties
+++ b/version.properties
@@ -16,13 +16,13 @@
# * specific language governing permissions and limitations
# * under the License.
# ***************************************************************
-target.ivy.version=2.5.2
+target.ivy.version=2.6.0
# Following OSGi spec: have to be 3 numbers separated by dots
-target.ivy.bundle.version=2.5.2
+target.ivy.bundle.version=2.6.0
# in case we want to add a qualifier such as alpha, beta, etc...
# if non empty, add a '_' at the end of the qualifier, so the version would look like 1.2.3.alpha_200901011200
# NB: be careful with naming, OSGi orders version alphabetically. Suggested values: alpha_, beta_, cr1_ (for RC-1), final_
-target.ivy.bundle.version.qualifier=final_
+target.ivy.bundle.version.qualifier=alpha_
# Versions of dependencies