Re: Build failed in Jenkins: java-identity-provider-multi-jdk » JDK-1.8 #322

[Cantor, Scott]

On 4/16/14, 1:41 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>I'm not sure this is fixable except by not using include/redefine, or by
>cirumventing those checks. Since by default I don't install a
>ResourceResolver, that's supposed to eventually block all remote schema
>access anyway. I'm testing that theory now, but if that's correct, one fix
>is by overriding the ACCESS_EXTERNAL_SCHEMA to "all", which would allow
>any scheme. That's insecure on the surface, but may be usable in practice.

My test shows that a working run of the test case never accesses any
remote HTTP sources.

Changing a schema to include the schema causing us problems over HTTP also
fails because the HTTP request gets blocked (the stream is empty and never
hits the network, which fits their documentation on how a null
ResourceResolver will behave).

So based on that, setting the property that's breaking classpath:/ lookups
to "all" doesn't really cause a security issue, but if one were to start
overriding the SchemaFactory properties and features, you'd be in a
serious foot-bullet situation pretty quickly because guarding the possible
combinations to try and prevent bad choices would be impractical.

There's a more concrete problem, which is that Xerces doesn't support the
ACCESS_EXTERNAL_SCHEMA property (Oracle does, but that's it). So I'd have
to trap setting it, which puts us in the situation we're in with the
DocumentBuilderFactory's defaults. I guess we don't really have a choice
here, we have to set these options or it just breaks now.

-- Scott