[JIRA] (JSSH-20) Spring is still falling through to remote access of XML files

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JSSH-20 ( https://shibboleth.atlassian.net/browse/JSSH-20?atlOrigin=eyJpIjoiZDI4NDlkNmFhMWVkNDc1NTkzZjMwMmYwNmEwYzQ2OWYiLCJwIjoiaiJ9 )

Re: Spring is still falling through to remote access of XML files ( https://shibboleth.atlassian.net/browse/JSSH-20?atlOrigin=eyJpIjoiZDI4NDlkNmFhMWVkNDc1NTkzZjMwMmYwNmEwYzQ2OWYiLCJwIjoiaiJ9 )

The problem isn’t that they don’t use an EntityResolver but that their ResourceEntityResolver class defaults to falling into http/s resolution.

Filed a Spring bug in case they decide to care, https://github.com/spring-projects/spring-framework/issues/29662 ( https://github.com/spring-projects/spring-framework/issues/29662 )

The problem is compounded by a gem of a comment inside JAXP in Java that basically says “if the ER returns null, should we really do it ourselves or return null?” Of course you know what they did. The only way around that is to throw an exception inside the EntityResolver.

Thus, the fix I found was to clone yet another Spring class and cut out the bad bits and add a log and throw.

I will add a canary test for this as well.

( https://shibboleth.atlassian.net/browse/JSSH-20#add-comment?atlOrigin=eyJpIjoiZDI4NDlkNmFhMWVkNDc1NTkzZjMwMmYwNmEwYzQ2OWYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JSSH-20#add-comment?atlOrigin=eyJpIjoiZDI4NDlkNmFhMWVkNDc1NTkzZjMwMmYwNmEwYzQ2OWYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100212- sha1:8cdcfbb )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221208/8b57c8ea/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-4a11d429-1471-4e65-a296-88585d54e5cb
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221208/8b57c8ea/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-f8e26747-afd3-4f1d-ad84-ea8bca649e9a
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221208/8b57c8ea/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-fcd85697-482c-466f-9c44-59660ec44f74
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221208/8b57c8ea/attachment-0005.png>