search

finos / messageml-utils

MessageML is a markup language used by the Symphony Agent API for representing messages, including formatting (bold, italic, numbered and unnumbered lists etc.) and entity data representing structured objects.
https://docs.developers.symphony.com
Apache License 2.0
12 stars 28 forks source link

Update dependency org.xmlunit:xmlunit-core to v2.10.0 [SECURITY] #395

Open renovate[bot] opened 6 months ago

renovate[bot] commented 6 months ago

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.xmlunit:xmlunit-core (source) 2.8.3 -> 2.10.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-31573

Impact

When performing XSLT transformations XMLUnit for Java did not disable XSLT extension functions by default. Depending on the XSLT processor being used this could allow arbitrary code to be executed when XMLUnit is used to transform data with a stylesheet who's source can not be trusted. If the stylesheet can be provided externally this may even lead to a remote code execution.

Patches

Users are advised to upgrade to XMLUnit for Java 2.10.0 where the default has been changed by means of https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b

Workarounds

XMLUnit's main use-case is performing tests on code that generates or processes XML. Most users will not use it to perform arbitrary XSLT transformations.

Users running XSLT transformations with untrusted stylesheets should explicitly use XMLUnit's APIs to pass in a pre-configured TraX TransformerFactory with extension functions disabled via features and attributes. The required setFactory or setTransformerFactory methods have been available since XMLUnit for Java 2.0.0.

References

Bug Report JAXP Security Guide

Release Notes

xmlunit/xmlunit (org.xmlunit:xmlunit-core) ### [`v2.10.0`](https://redirect.github.com/xmlunit/xmlunit/blob/HEAD/RELEASE_NOTES.md#XMLUnit-for-Java-2100---Released-2024-04-28) [Compare Source](https://redirect.github.com/xmlunit/xmlunit/compare/v2.9.1...v2.10.0) - add a new `ElementSelectors.byNameAndAllAttributes` variant that filters attributes before deciding whether elements can be compared. Inspired by Issue [#​259](https://redirect.github.com/xmlunit/xmlunit/issues/259) - By default the `TransformerFactory`s created will now try to disable extension functions. If you need extension functions for your transformations you may want to pass in your own instance of `TransformerFactory` and `TransformerFactoryConfigurer` may help with that. Inspired by Issue [#​264](https://redirect.github.com/xmlunit/xmlunit/issues/264) This is tracked as [CVE-2024-31573](https://redirect.github.com/xmlunit/xmlunit/security/advisories/GHSA-chfm-68vv-pvw5). - `JAXPXPathEngine` will now try to disable the execution of extension functions by default but uses `XPathFactory#setProperty` which is not available prior to Java 18. You may want to enable secure processing on an `XPathFactory` instance you pass to `JAXPXPathEngine` instead - and `XPathFactoryConfigurer` may help with that. ### [`v2.9.1`](https://redirect.github.com/xmlunit/xmlunit/blob/HEAD/RELEASE_NOTES.md#XMLUnit-for-Java-291---Released-2023-01-10) [Compare Source](https://redirect.github.com/xmlunit/xmlunit/compare/v2.9.0...v2.9.1) - fixed some AssertJ tests that didn't work on Windows. Issue [#​252](https://redirect.github.com/xmlunit/xmlunit/issues/252) and PR [#​253](https://redirect.github.com/xmlunit/xmlunit/issues/253) by [@​Boiarshinov](https://redirect.github.com/Boiarshinov) - added overloads to `ElementSelectors.byXPath` that accept a `XPathEngine` argument. Issue [#​255](https://redirect.github.com/xmlunit/xmlunit/issues/255) - added Cyclone DX SBOMs to release artifacts ### [`v2.9.0`](https://redirect.github.com/xmlunit/xmlunit/blob/HEAD/RELEASE_NOTES.md#XMLUnit-for-Java-290---Released-2022-01-25) [Compare Source](https://redirect.github.com/xmlunit/xmlunit/compare/v2.8.4...v2.9.0) - added a new module `xmlunit-jakarta-jaxb-impl` that makes `Input.fromJaxb` use `jakarta.xml.bind` rather than `javax.xml.bind`. For more details see the [User's Guide](https://redirect.github.com/xmlunit/user-guide/wiki/JAXB). This change is not fully backwards compatible. The `JaxbBuilder` class has become abstract and the `withMarshaller` method has changed its signature. For most cases the change will not be noticed and for almost all other cases it should be enough to re-compile your code against XMLUnit 2.9.x. Issue [#​227](https://redirect.github.com/xmlunit/xmlunit/issues/227) and PR [#​247](https://redirect.github.com/xmlunit/xmlunit/issues/247) - added `NodeFilters#satisfiesAll` and `satifiesAny` methods to make it easier to combine multiple node filters. added to simplify the use case of [#​249](https://redirect.github.com/xmlunit/xmlunit/issues/249) ### [`v2.8.4`](https://redirect.github.com/xmlunit/xmlunit/blob/HEAD/RELEASE_NOTES.md#XMLUnit-for-Java-284---Released-2021-12-16) [Compare Source](https://redirect.github.com/xmlunit/xmlunit/compare/v2.8.3...v2.8.4) - improved comparison performance for documents with many siblings based on a suggestion by [@​gerpres](https://redirect.github.com/gerpres) made in [#​236](https://redirect.github.com/xmlunit/xmlunit/issues/236)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR was generated by Mend Renovate. View the repository job log.