Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NO-ISSUE: Fix load external schemas vulnerability #3192

Merged
merged 1 commit into from
Aug 30, 2023

Conversation

jomarko
Copy link
Contributor

@jomarko jomarko commented Aug 29, 2023

The sonar reports https://rules.sonarsource.com/java/RSPEC-6374/ vulnerability for jbpm/jbpm-flow-builder/src/main/java/org/jbpm/compiler/xml/core/ExtensibleXmlParser.java

Many thanks for submitting your Pull Request ❤️!

Please make sure that your PR meets the following requirements:

  • You have read the contributors guide
  • Your code is properly formatted according to this configuration
  • Pull Request title is properly formatted: KOGITO-XYZ Subject
  • Pull Request title contains the target branch if not targeting main: [0.9.x] KOGITO-XYZ Subject
  • Pull Request contains link to the JIRA issue
  • Pull Request contains link to any dependent or related Pull Request
  • Pull Request contains description of the issue
  • Pull Request does not include fixes for issues other than the main ticket
How to replicate CI configuration locally?

Build Chain tool does "simple" maven build(s), the builds are just Maven commands, but because the repositories relates and depends on each other and any change in API or class method could affect several of those repositories there is a need to use build-chain tool to handle cross repository builds and be sure that we always use latest version of the code for each repository.

build-chain tool is a build tool which can be used on command line locally or in Github Actions workflow(s), in case you need to change multiple repositories and send multiple dependent pull requests related with a change you can easily reproduce the same build by executing it on Github hosted environment or locally in your development environment. See local execution details to get more information about it.

How to retest this PR or trigger a specific build:
  • for pull request checks
    Please add comment: Jenkins retest this

  • for a specific pull request check
    Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] tests

  • for quarkus branch checks
    Run checks against Quarkus current used branch
    Please add comment: Jenkins run quarkus-branch

  • for a quarkus branch specific check
    Run checks against Quarkus current used branch
    Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] quarkus-branch

  • for quarkus main checks
    Run checks against Quarkus main branch
    Please add comment: Jenkins run quarkus-main

  • for a specific quarkus main check
    Run checks against Quarkus main branch
    Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] quarkus-main

  • for quarkus lts checks
    Run checks against Quarkus lts branch
    Please add comment: Jenkins run quarkus-lts

  • for a specific quarkus lts check
    Run checks against Quarkus lts branch
    Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] quarkus-lts

  • for native checks
    Run native checks
    Please add comment: Jenkins run native

  • for a specific native check
    Run native checks
    Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] native

  • for native lts checks
    Run native checks against quarkus lts branch
    Please add comment: Jenkins run native-lts

  • for a specific native lts check
    Run native checks against quarkus lts branch
    Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] native-lts

How to backport a pull request to a different branch?

In order to automatically create a backporting pull request please add one or more labels having the following format backport-<branch-name>, where <branch-name> is the name of the branch where the pull request must be backported to (e.g., backport-7.67.x to backport the original PR to the 7.67.x branch).

NOTE: backporting is an action aiming to move a change (usually a commit) from a branch (usually the main one) to another one, which is generally referring to a still maintained release branch. Keeping it simple: it is about to move a specific change or a set of them from one branch to another.

Once the original pull request is successfully merged, the automated action will create one backporting pull request per each label (with the previous format) that has been added.

If something goes wrong, the author will be notified and at this point a manual backporting is needed.

NOTE: this automated backporting is triggered whenever a pull request on main branch is labeled or closed, but both conditions must be satisfied to get the new PR created.

Quarkus-3 PR check is failing ... what to do ? The Quarkus 3 check is applying patches from the `.ci/environments/quarkus-3/patches`.

The first patch, called 0001_before_sh.patch, is generated from Openrewrite .ci/environments/quarkus-3/quarkus3.yml recipe. The patch is created to speed up the check. But it may be that some changes in the PR broke this patch.
No panic, there is an easy way to regenerate it. You just need to comment on the PR:

jenkins rewrite quarkus-3

and it should, after some minutes (~20/30min) apply a commit on the PR with the patch regenerated.

Other patches were generated manually. If any of it fails, you will need to manually update it... and push your changes.

The sonar reports https://rules.sonarsource.com/java/RSPEC-6374/ vulnerability for `jbpm/jbpm-flow-builder/src/main/java/org/jbpm/compiler/xml/core/ExtensibleXmlParser.java`
@kie-ci3
Copy link
Contributor

kie-ci3 commented Aug 29, 2023

(tests) - serverless-workflow-examples job #1396 was: UNSTABLE
Possible explanation: This should be test failures

Reproducer

export BUILD_MVN_OPTS_CURRENT=
build-chain build cross_pr -f 'https://raw.githubusercontent.com/kiegroup/kogito-pipelines/main/.ci/pull-request-config.yaml' -o 'bc' -p kiegroup/kogito-examples -u https://github.com/kiegroup/kogito-runtimes/pull/3192 --skipParallelCheckout

NOTE: To install the build-chain tool, please refer to https://github.com/kiegroup/github-action-build-chain#local-execution

Please look here: https://eng-jenkins-csb-business-automation.apps.ocp-c1.prod.psi.redhat.com/job/KIE/job/kogito/job/main/job/pullrequest/job/kogito-runtimes.tests.downstream.serverless-workflow-examples/1396/display/redirect

Test results:

  • PASSED: 81
  • FAILED: 1

Those are the test failures:

org.kie.kogito.examples.OpenVinoRestIT.testOpenvino 1 expectation failed.
JSON path workflowdata.group doesn't match.
Expected: a string containing "flat-coated retriever"
Actual: <[]>

@sonarcloud
Copy link

sonarcloud bot commented Aug 29, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

100.0% 100.0% Coverage
0.0% 0.0% Duplication

@jomarko
Copy link
Contributor Author

jomarko commented Aug 30, 2023

Jenkins rerun serverless-workflow-examples tests

@kie-ci3
Copy link
Contributor

kie-ci3 commented Aug 30, 2023

(tests) - serverless-workflow-examples job #1412 was: UNSTABLE
Possible explanation: This should be test failures

Reproducer

export BUILD_MVN_OPTS_CURRENT=
build-chain build cross_pr -f 'https://raw.githubusercontent.com/kiegroup/kogito-pipelines/main/.ci/pull-request-config.yaml' -o 'bc' -p kiegroup/kogito-examples -u https://github.com/kiegroup/kogito-runtimes/pull/3192 --skipParallelCheckout

NOTE: To install the build-chain tool, please refer to https://github.com/kiegroup/github-action-build-chain#local-execution

Please look here: https://eng-jenkins-csb-business-automation.apps.ocp-c1.prod.psi.redhat.com/job/KIE/job/kogito/job/main/job/pullrequest/job/kogito-runtimes.tests.downstream.serverless-workflow-examples/1412/display/redirect

Test results:

  • PASSED: 81
  • FAILED: 1

Those are the test failures:

org.kie.kogito.examples.OpenVinoRestIT.testOpenvino 1 expectation failed.
JSON path workflowdata.group doesn't match.
Expected: a string containing "flat-coated retriever"
Actual: <[]>

@fjtirado
Copy link
Contributor

jenkins run serverless-workflow-examples tests

@fjtirado fjtirado merged commit c4c370c into apache:main Aug 30, 2023
7 checks passed
@jomarko jomarko deleted the loading-external branch August 31, 2023 05:44
@@ -265,6 +265,7 @@ public Object read(final InputSource in) throws SAXException,
try {
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this does not exist so there is no point to set it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

my bad.

http://apache.org/xml/features/nonvalidating/load-external-dtd   http://apache.org/xml/features/nonvalidating/load-external-dtd        
  http://apache.org/xml/features/nonvalidating/load-external-dtd  
     
  True: Load the external DTD. False: Ignore the external DTD completely. Default: true Note: This feature is always on when validation is on. See: http://xml.org/sax/features/validation See: http://apache.org/xml/features/nonvalidating/load-dtd-grammar True: Load the external DTD. False: Ignore the external DTD completely. Default:
True: Load the external DTD.
False: Ignore the external DTD completely.
Default: true
Note: This feature is always on when validation is on.
See: http://xml.org/sax/features/validation
See: http://apache.org/xml/features/nonvalidating/load-dtd-grammar
it does exists

http://apache.org/xml/features/nonvalidating/load-external-dtd

True: Load the external DTD.
False: Ignore the external DTD completely.
Default: true
Note: This feature is always on when validation is on.
See: http://xml.org/sax/features/validation
See: http://apache.org/xml/features/nonvalidating/load-dtd-grammar

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants