IVY-1647 better check whether properties/features can be set

apache · Sep 15, 2023 · 5d69c9a · 5d69c9a
1 parent e00e9e0
commit 5d69c9a
Show file tree

Hide file tree

Showing 3 changed files with 59 additions and 7 deletions.
diff --git a/asciidoc/release-notes.adoc b/asciidoc/release-notes.adoc
@@ -19,7 +19,7 @@
 
 = Ivy Release Announcement
 
-XXXX Date XXXX - The Apache Ivy project is pleased to announce its 2.6.0 release.
+XXXX Date XXXX - The Apache Ivy project is pleased to announce its 2.5.3 release.
 
 == What is Ivy?
 Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies, characterized by flexibility,
@@ -34,14 +34,16 @@ More information about the project can be found on the website link:https://ant.
 
 == Key features in this release
 
-Key features of this 2.6.0 release are:
+Key features of this 2.5.3 release are:
 
 == List of Changes in this Release
 
 For details about the following changes, check our JIRA install at link:https://issues.apache.org/jira/browse/IVY[]
 
 *List of changes since Ivy 2.5.2:*
 
+- FIX: trying to set safe XML features causes SAXExceptions when used with certain XML parsers (jira:IVY-1647[])
+
 ////
  Samples :
 - NEW: bla bla bla (jira:IVY-1234[]) (Thanks to Jane Doe)

diff --git a/src/java/org/apache/ivy/util/XMLHelper.java b/src/java/org/apache/ivy/util/XMLHelper.java
@@ -88,9 +88,11 @@ private static SAXParser newSAXParser(final URL schema, final InputStream schema
             }
         }
         final XMLReader reader = parser.getXMLReader();
-        reader.setFeature(XML_NAMESPACE_PREFIXES, true);
-        reader.setProperty(XML_ACCESS_EXTERNAL_SCHEMA, externalResources.getAllowedProtocols());
-        reader.setProperty(XML_ACCESS_EXTERNAL_DTD, externalResources.getAllowedProtocols());
+        trySetFeature(reader, XML_NAMESPACE_PREFIXES, true);
+        trySetProperty(reader, XML_ACCESS_EXTERNAL_SCHEMA,
+                       externalResources.getAllowedProtocols());
+        trySetProperty(reader, XML_ACCESS_EXTERNAL_DTD,
+                       externalResources.getAllowedProtocols());
         return parser;
     }
 
@@ -425,6 +427,15 @@ private static boolean isFeatureSupported(final DocumentBuilderFactory factory,
         }
     }
 
+    private static boolean isFeatureSupported(final XMLReader reader, final String feature) {
+        try {
+            reader.getFeature(feature);
+            return true;
+        } catch (SAXException e) {
+            return false;
+        }
+    }
+
     private static boolean isAttributeSupported(final TransformerFactory factory, final String attribute) {
         try {
             factory.getAttribute(attribute);
@@ -434,6 +445,15 @@ private static boolean isAttributeSupported(final TransformerFactory factory, fi
         }
     }
 
+    private static boolean isPropertySupported(final XMLReader reader, final String property) {
+        try {
+            reader.getProperty(property);
+            return true;
+        } catch (SAXException e) {
+            return false;
+        }
+    }
+
     private static boolean trySetFeature(final DocumentBuilderFactory factory,
                                                final String feature, final boolean val) {
         if (!isFeatureSupported(factory, feature)) {
@@ -472,6 +492,21 @@ private static boolean trySetFeature(final SAXParserFactory factory,
         }
     }
 
+    private static boolean trySetFeature(final XMLReader reader,
+                                         final String feature, final boolean val) {
+        if (!isFeatureSupported(reader, feature)) {
+            return false;
+        }
+        try {
+            reader.setFeature(feature, val);
+            return true;
+        } catch (SAXException e) {
+            // log and continue
+            Message.warn("Failed to set feature " + feature + " on XMLReader", e);
+            return false;
+        }
+    }
+
     private static boolean trySetAttribute(final TransformerFactory factory,
                                          final String attribute, final String val) {
         if (!isAttributeSupported(factory, attribute)) {
@@ -487,6 +522,21 @@ private static boolean trySetAttribute(final TransformerFactory factory,
         }
     }
 
+    private static boolean trySetProperty(final XMLReader reader,
+                                          final String property, final Object val) {
+        if (!isPropertySupported(reader, property)) {
+            return false;
+        }
+        try {
+            reader.setProperty(property, val);
+            return true;
+        } catch (SAXException e) {
+            // log and continue
+            Message.warn("Failed to set property " + property + " on XMLReader", e);
+            return false;
+        }
+    }
+
     private static final InputSource EMPTY_INPUT_SOURCE = new InputSource(new StringReader(""));
 
     private static class NoopEntityResolver implements EntityResolver {

diff --git a/version.properties b/version.properties
@@ -16,9 +16,9 @@
 #	 * specific language governing permissions and limitations
 #	 * under the License.
 #	 ***************************************************************
-target.ivy.version=2.6.0
+target.ivy.version=2.5.3
 # Following OSGi spec: have to be 3 numbers separated by dots
-target.ivy.bundle.version=2.6.0
+target.ivy.bundle.version=2.5.3
 # in case we want to add a qualifier such as alpha, beta, etc...
 # if non empty, add a '_' at the end of the qualifier, so the version would look like 1.2.3.alpha_200901011200
 # NB: be careful with naming, OSGi orders version alphabetically. Suggested values: alpha_, beta_, cr1_ (for RC-1), final_