Bump xalan from version 2.7.2 to version 2.7.3 #4902

turing85 · 2023-05-15T20:17:19Z

Bump xalan from version 2.7.2 to version 2.7.3

turing85 · 2023-05-15T21:32:59Z

@oscerd could you re-approve the workflows? I had to force-push some changes in order to make the pipeline succeed.

zhfeng · 2023-05-16T06:08:02Z

It seem that there are java.lang.ClassNotFoundException: org.apache.xml.serializer.OutputPropertiesFactory

jamesnetherton · 2023-05-16T06:12:20Z

It seem that there are java.lang.ClassNotFoundException: org.apache.xml.serializer.OutputPropertiesFactory

The 2.7.3 POM is a bit screwed up compared with 2.7.2. It is missing dependencies.

https://issues.apache.org/jira/browse/XALANJ-2649

turing85 · 2023-05-16T06:15:10Z

Oh nice... so... should we close this PR and wait for an update instead?

jamesnetherton · 2023-05-16T06:24:34Z

Oh nice... so... should we close this PR and wait for an update instead?

It's not clear to me whether they are going to patch it or not....

I think we could work around it by adding xalan:serializer into poms/bom/pom.xml and also into extensions-support/xalan/runtime/pom.xml. Afterwards, if you run mvn clean install in poms it'll regenerate the BOM files.

turing85 · 2023-05-16T10:03:16Z

Oh nice... so... should we close this PR and wait for an update instead?

It's not clear to me whether they are going to patch it or not....

I think we could work around it by adding xalan:serializer into poms/bom/pom.xml and also into extensions-support/xalan/runtime/pom.xml. Afterwards, if you run mvn clean install in poms it'll regenerate the BOM files.

Okay, will update my PR as soon as I have some time. There is, however, a major concern here: CVE-2022-34169. For me, it is unclear whether the issue is actually fixed in 2.7.3, or whether it is just "gone" due to the missing dependencies.

turing85 · 2023-05-16T17:21:16Z

@jamesnetherton @oscerd @zhfeng Updated the PR, xalan:serializer is now in the dependencies. Could you re-approve to trigger the pipeline run?

- Add xalan:serializer dependency since it is missing from xalan's pom

turing85 · 2023-05-16T20:12:27Z

... welp...

ppalaga · 2023-05-17T10:14:45Z

There is, however, a major concern here: CVE-2022-34169. For me, it is unclear whether the issue is actually fixed in 2.7.3, or whether it is just "gone" due to the missing dependencies.

The fix commit seems to be this one apache/xalan-java@2e60d0a
That's definitely in Xalan.

turing85 · 2023-05-17T10:42:06Z

There is, however, a major concern here: CVE-2022-34169. For me, it is unclear whether the issue is actually fixed in 2.7.3, or whether it is just "gone" due to the missing dependencies.

The fix commit seems to be this one apache/xalan-java@2e60d0a That's definitely in Xalan.

Okay nice. Only question is now: what is missing so that the pipeline succeeds?

ppalaga · 2023-05-17T10:59:24Z

what is missing so that the pipeline succeeds?

Let me have a look

ppalaga · 2023-05-17T20:08:37Z

I was able to do some hacks to make the XML security test pass - see https://github.com/ppalaga/camel-quarkus/commits/pr4902
I unfortunately have no more time fix the failing XML test.

zhfeng · 2023-05-23T06:37:16Z

The XML test are weired. They are working in JVM mode but throwing the Exception during native building.

[ERROR] org/apache/camel/quarkus/component/xslt/generated/ClasspathTransform (wrong name: org/apache/xalan/xsltc/runtime/AbstractTranslet)
javax.xml.transform.TransformerException: org/apache/camel/quarkus/component/xslt/generated/ClasspathTransform (wrong name: org/apache/xalan/xsltc/runtime/AbstractTranslet)
    at org.apache.xalan.xsltc.trax.TransformerFactoryImpl.passErrorsToListener (TransformerFactoryImpl.java:661)
    at org.apache.xalan.xsltc.trax.TransformerFactoryImpl.newTemplates (TransformerFactoryImpl.java:836)
    at org.apache.camel.quarkus.support.xalan.XalanTransformerFactory.newTemplates (XalanTransformerFactory.java:70)
    at org.apache.camel.quarkus.component.xslt.deployment.XsltProcessor.xsltResources (XsltProcessor.java:119)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:568)
    at io.quarkus.deployment.ExtensionLoader$3.execute (ExtensionLoader.java:909)
    at io.quarkus.builder.BuildContext.run (BuildContext.java:281)
    at org.jboss.threads.ContextHandler$1.runWith (ContextHandler.java:18)
    at org.jboss.threads.EnhancedQueueExecutor$Task.run (EnhancedQueueExecutor.java:2449)
    at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run (EnhancedQueueExecutor.java:1478)
    at java.lang.Thread.run (Thread.java:833)
    at org.jboss.threads.JBossThread.run (JBossThread.java:501)
[ERROR] Could not compile stylesheet
javax.xml.transform.TransformerConfigurationException: Could not compile stylesheet
    at org.apache.xalan.xsltc.trax.TransformerFactoryImpl.newTemplates (TransformerFactoryImpl.java:832)
    at org.apache.camel.quarkus.support.xalan.XalanTransformerFactory.newTemplates (XalanTransformerFactory.java:70)
    at org.apache.camel.quarkus.component.xslt.deployment.XsltProcessor.xsltResources (XsltProcessor.java:119)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:568)
    at io.quarkus.deployment.ExtensionLoader$3.execute (ExtensionLoader.java:909)
    at io.quarkus.builder.BuildContext.run (BuildContext.java:281)
    at org.jboss.threads.ContextHandler$1.runWith (ContextHandler.java:18)
    at org.jboss.threads.EnhancedQueueExecutor$Task.run (EnhancedQueueExecutor.java:2449)
    at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run (EnhancedQueueExecutor.java:1478)
    at java.lang.Thread.run (Thread.java:833)
    at org.jboss.threads.JBossThread.run (JBossThread.java:501)

I will take a look.

zhfeng · 2023-06-02T02:37:25Z

Well, it seems that xalan 2.7.3 added a new checking before dumping a generated translet class. See https://github.com/apache/xalan-java/blame/master/src/org/apache/xalan/xsltc/compiler/XSLTC.java#L860-L865

 byte[] classByteArray = clazz.getBytes();
 ByteArrayClassLoader classLoader = new ByteArrayClassLoader(classByteArray);
 Class clz = classLoader.findClass(clazz.getClassName());

And ByteArrayClassLoader can not find org.apache.xalan.xsltc.runtime.AbstractTranslet during the quarkus-maven-plugin runs AugmentAction. I guess that it uses a different class loader in quarkus-maven-plugin and ByteArrayClassLoader is inherited from SystemClassLoader.

I have no idea how to fix it and don't undertand the motivation for the checking in XSLTC.

turing85 · 2023-06-02T08:14:04Z

Sooo... what's our course of action now? Xalan 2.7.2 is vulnerable to https://cve.circl.lu/cve/CVE-2022-34169 and 2.7.3 does not seem to work.

ppalaga · 2023-06-02T08:30:36Z

@zhfeng could you please try changing the constructor of ByteArrayClassLoader so that it uses something like super(Thread.currentThread().getContextClassLoader() != null ? Thread.currentThread().getContextClassLoader() : ClassLoader.getSystemClassLoader())? If it works for us, we should file a Xalan issue and send a PR.

ppalaga · 2023-06-02T08:33:08Z

something like super(Thread.currentThread().getContextClassLoader() != null ? Thread.currentThread().getContextClassLoader() : ClassLoader.getSystemClassLoader())

Or even better ~~super(Thread.currentThread().getContextClassLoader() != null ? XSLTC.class.getClassLoader() : ClassLoader.getSystemClassLoader())~~
super(Thread.currentThread().getContextClassLoader() != null ? Thread.currentThread().getContextClassLoader() : XSLTC.class.getClassLoader())

zhfeng · 2023-06-02T08:34:41Z

@ppalaga yeah, I tried such changes and it works with TCCL.

ppalaga · 2023-06-02T08:36:37Z

Let's propose it in Xalan then. Should I help with formulating why we need it?

zhfeng · 2023-06-02T08:38:15Z

Yeah, please file an issue on XALANJ ?

ppalaga · 2023-06-02T08:43:51Z

You mean I should file an issue on Xalan? - no problem, let me do it.

zhfeng · 2023-06-02T08:59:37Z

super(Thread.currentThread().getContextClassLoader() != null ? Thread.currentThread().getContextClassLoader() : XSLTC.class.getClassLoader())

@ppalaga I'm just curious in what case the TCCL is null?

ppalaga · 2023-06-02T09:15:36Z

@ppalaga I'm just curious in what case the TCCL is null?

When it is not set via Thread.currentThread().setContextClassLoader(...) - it is quite a normal situation.

ppalaga · 2023-06-02T09:16:47Z

I filed https://issues.apache.org/jira/browse/XALANJ-2664

ppalaga · 2023-06-02T09:17:43Z

I filed https://issues.apache.org/jira/browse/XALANJ-2664

Would you like to care for sending the PR, @zhfeng ?

zhfeng · 2023-06-02T09:23:51Z

Thanks @ppalaga and I will prepare a PR.

zhfeng · 2023-06-02T09:44:27Z

@ppalaga I'm just curious in what case the TCCL is null?

When it is not set via Thread.currentThread().setContextClassLoader(...) - it is quite a normal situation.

IIRC, the default value of TCCL is System Class Loader. So if there is no setContextClassLoader(null) explicitly, it should be always not empty?

oscerd approved these changes May 15, 2023

View reviewed changes

turing85 force-pushed the feature/2.13.x/bump-xalan-version branch from a3b174c to 44f7dc1 Compare May 15, 2023 21:29

turing85 force-pushed the feature/2.13.x/bump-xalan-version branch from 44f7dc1 to 1d85d7a Compare May 16, 2023 17:20

- Bump xalan from version 2.7.2 to version 2.7.3

1d1cf8e

- Add xalan:serializer dependency since it is missing from xalan's pom

turing85 force-pushed the feature/2.13.x/bump-xalan-version branch from 1d85d7a to 1d1cf8e Compare May 16, 2023 17:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump xalan from version 2.7.2 to version 2.7.3 #4902

Bump xalan from version 2.7.2 to version 2.7.3 #4902

turing85 commented May 15, 2023

turing85 commented May 15, 2023

zhfeng commented May 16, 2023

jamesnetherton commented May 16, 2023

turing85 commented May 16, 2023

jamesnetherton commented May 16, 2023

turing85 commented May 16, 2023

turing85 commented May 16, 2023

turing85 commented May 16, 2023

ppalaga commented May 17, 2023

turing85 commented May 17, 2023

ppalaga commented May 17, 2023

ppalaga commented May 17, 2023

zhfeng commented May 23, 2023

zhfeng commented Jun 2, 2023

turing85 commented Jun 2, 2023

ppalaga commented Jun 2, 2023

ppalaga commented Jun 2, 2023 •

edited

Loading

zhfeng commented Jun 2, 2023

ppalaga commented Jun 2, 2023

zhfeng commented Jun 2, 2023 •

edited

Loading

ppalaga commented Jun 2, 2023

zhfeng commented Jun 2, 2023

ppalaga commented Jun 2, 2023

ppalaga commented Jun 2, 2023

ppalaga commented Jun 2, 2023

zhfeng commented Jun 2, 2023

zhfeng commented Jun 2, 2023

Bump xalan from version 2.7.2 to version 2.7.3 #4902

Are you sure you want to change the base?

Bump xalan from version 2.7.2 to version 2.7.3 #4902

Conversation

turing85 commented May 15, 2023

turing85 commented May 15, 2023

zhfeng commented May 16, 2023

jamesnetherton commented May 16, 2023

turing85 commented May 16, 2023

jamesnetherton commented May 16, 2023

turing85 commented May 16, 2023

turing85 commented May 16, 2023

turing85 commented May 16, 2023

ppalaga commented May 17, 2023

turing85 commented May 17, 2023

ppalaga commented May 17, 2023

ppalaga commented May 17, 2023

zhfeng commented May 23, 2023

zhfeng commented Jun 2, 2023

turing85 commented Jun 2, 2023

ppalaga commented Jun 2, 2023

ppalaga commented Jun 2, 2023 • edited Loading

zhfeng commented Jun 2, 2023

ppalaga commented Jun 2, 2023

zhfeng commented Jun 2, 2023 • edited Loading

ppalaga commented Jun 2, 2023

zhfeng commented Jun 2, 2023

ppalaga commented Jun 2, 2023

ppalaga commented Jun 2, 2023

ppalaga commented Jun 2, 2023

zhfeng commented Jun 2, 2023

zhfeng commented Jun 2, 2023

ppalaga commented Jun 2, 2023 •

edited

Loading

zhfeng commented Jun 2, 2023 •

edited

Loading