Could not load document because it is not whitelisted

[naturzukunft]

Hi there, i currently try to upgrade some dependencies in my project.

among others:
<rdf4j.version>5.0.0-M2</rdf4j.version>
->
<rdf4j.version>5.0.2</rdf4j.version>

no i run into problems executing my tests with an error:

Caused by: org.eclipse.rdf4j.rio.RDFParseException: Could not load document from https://www.w3.org/ns/activitystreams because it is not whitelisted. See: JSONLDSettings.WHITELIST and JSONLDSettings.SECURE_MODE which can also be set as system properties.

i already tried:
mvn -Dorg.eclipse.rdf4j.rio.jsonld_secure_mode=true test
but with no effect.

Was there a change from 5.0.0-M2 to 5.0.2? Or do i have another problem ?

Thanks Fredy

[hmottestad]

Yeah, this is a change from the milestone build. We consider it a security risk that the JSON-LD parser can load an arbitrary file on your local machine or contact an arbitrary server on your local network, even though it breaks with the spec.

You can disable it with: -Dorg.eclipse.rdf4j.rio.jsonld_secure_mode=false

Or with a parser config:

parser.getParserConfig().set(SECURE_MODE, false);

We can also adjust our whitelist a bit. I see that we have http://www.w3.org/ns/activitystreams.jsonld in the whitelist, but we should probably also add the https variant and one without .jsonld.

[naturzukunft]

The extensions certainly make sense! However, it would be easier if I could extend the WHITELIST of the parser, as I will certainly need more contexts

[naturzukunft]

-Dorg.eclipse.rdf4j.rio.jsonld_secure_mode=false

ok, I've made a silly mistake with true :-)

[hmottestad]

You can set the whitelist to a string like this: ["http://example.org/","http://schema.org"]

[hmottestad]

System property is org.eclipse.rdf4j.rio.jsonld_whitelist