[OpenNMS/opennms] fb9ba8: NMS-20206: Fix XXE in XML collector (#8782)

  Branch: refs/heads/cg/jira/NMS-20110
  Home:   https://github.com/OpenNMS/opennms
  Commit: fb9ba8bd48f27eedef18b3f0fbf0cfc8a8c22ca4
      https://github.com/OpenNMS/opennms/commit/fb9ba8bd48f27eedef18b3f0fbf0cfc8a8c22ca4
  Author: Chandra Gorantla <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M docs/modules/reference/pages/performance-data-collection/collectors/xml.adoc
    M protocols/xml/src/main/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandler.java
    M protocols/xml/src/test/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandlerTest.java

  Log Message:
  -----------
  NMS-20206: Fix XXE in XML collector (#8782)

* NMS-20206: Fix XXE in XML collector

Disable external entity/DTD resolution in AbstractXmlCollectionHandler's
DocumentBuilderFactory and TransformerFactory so collected XML cannot read local
files or trigger out-of-band requests. Avoids disallow-doctype-decl to keep
pre-parse-html working. Adds regression tests.

* NMS-20206: Handle review comments

* NMS-20206: Handle some more review comments

Disable external entity/DTD resolution in the DocumentBuilder and, for the
xslt-source-file path, parse the stylesheet and collected source through a
hardened XMLReader (SAXSource) so XXE is blocked even under Xalan. Adds
regression tests.

* NMS-20206: Add some more protections

* NMS-20206: Update docs

* NMS-20206: Add ErrorListener


  Commit: 9dbc420da3b3039d59946b16e978fac9724809a2
      https://github.com/OpenNMS/opennms/commit/9dbc420da3b3039d59946b16e978fac9724809a2
  Author: Chandra Gorantla <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M integration-tests/config/pom.xml

  Log Message:
  -----------
  NMS-20226: Updates missing jackson2AnnotationsVersion


  Commit: 2e76241023e776c97ce55792d9a4ef3af725b6ba
      https://github.com/OpenNMS/opennms/commit/2e76241023e776c97ce55792d9a4ef3af725b6ba
  Author: CI/CD System <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M docs/modules/reference/pages/performance-data-collection/collectors/xml.adoc
    M protocols/xml/src/main/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandler.java
    M protocols/xml/src/test/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandlerTest.java

  Log Message:
  -----------
  Merge remote-tracking branch 'origin/foundation-2023' into foundation-2024


  Commit: 42f848bd56e97e86d27bdd30a4c47c4b9c76abe9
      https://github.com/OpenNMS/opennms/commit/42f848bd56e97e86d27bdd30a4c47c4b9c76abe9
  Author: CI/CD System <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M docs/modules/reference/pages/performance-data-collection/collectors/xml.adoc
    M protocols/xml/src/main/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandler.java
    M protocols/xml/src/test/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandlerTest.java

  Log Message:
  -----------
  Merge remote-tracking branch 'origin/foundation-2024' into foundation-2025


  Commit: 0187081573367af778ae57b4893a752684835332
      https://github.com/OpenNMS/opennms/commit/0187081573367af778ae57b4893a752684835332
  Author: Chandra Gorantla <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M smoke-test/src/test/java/org/opennms/smoketest/MenuHeaderIT.java

  Log Message:
  -----------
  update search element, fix MenuHeaderIT


  Commit: 22c9726c5d87a5a1c5a0e5c8685a7c5e4cbf5096
      https://github.com/OpenNMS/opennms/commit/22c9726c5d87a5a1c5a0e5c8685a7c5e4cbf5096
  Author: Morteza E <[email protected]>
  Date:   2026-08-21 (Fri, 21 Aug 2026)

  Changed paths:
    M docs/modules/reference/pages/performance-data-collection/collectors/xml.adoc
    M protocols/xml/src/main/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandler.java
    M protocols/xml/src/test/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandlerTest.java

  Log Message:
  -----------
  Merge remote-tracking branch 'origin/foundation-2025' into foundation-2026


  Commit: 81110f3351a6d1237f13b645a9972fcc8d84192b
      https://github.com/OpenNMS/opennms/commit/81110f3351a6d1237f13b645a9972fcc8d84192b
  Author: Chandra Gorantla <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M docs/modules/reference/pages/performance-data-collection/collectors/xml.adoc
    M integration-tests/config/pom.xml
    M protocols/xml/src/main/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandler.java
    M protocols/xml/src/test/java/org/opennms/protocols/xml/collector/AbstractXmlCollectionHandlerTest.java
    M smoke-test/src/test/java/org/opennms/smoketest/MenuHeaderIT.java

  Log Message:
  -----------
  Merge branch 'foundation-2026' into cg/jira/NMS-20110


Compare: https://github.com/OpenNMS/opennms/compare/81e333c9d947...81110f3351a6

To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs