Skip to content

Allow access to schemas in nested JARs - #528

Merged
ohr merged 1 commit into
oehf:masterfrom
qligier:fix/fat-jar-xml-security
Oct 13, 2026
Merged

ohr merged 1 commit into
oehf:masterfrom
qligier:fix/fat-jar-xml-security

Conversation

@qligier

@qligier qligier commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

Hello! While migration an application to IPF 6.0.0, I encountered a new bug preventing the load of some schemas.
My app is packaged as a fat JAR by spring-boot-maven-plugin, which means the schema URLs look like jar:nested:/myapp.jar/!BOOT-INF/lib/ipf.jar!/schema/x.xsd. The current LOCAL_ACCESS_ONLY prevents such URLs using nested from being accessed, since it only allows jar and file.

Example error stack trace:

org.openehealth.ipf.commons.core.modules.api.ValidationException: Unexpected validation failure because Could not initialize XSD schema
Could not initialize XSD schema
        at org.openehealth.ipf.commons.xml.XsdValidator.validate(XsdValidator.java:67) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        at org.openehealth.ipf.commons.xml.CombinedXmlValidator.validate(CombinedXmlValidator.java:47) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        ... 23 common frames omitted
Caused by: org.openehealth.ipf.commons.core.modules.api.ValidationException: Unexpected validation failure because Could not initialize XSD schema
Could not initialize XSD schema
        at org.openehealth.ipf.commons.xml.XsdValidator.doValidate(XsdValidator.java:100) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        at org.openehealth.ipf.commons.xml.XsdValidator.validate(XsdValidator.java:65) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        ... 33 common frames omitted
Caused by: java.lang.IllegalArgumentException: Could not initialize XSD schema
        at org.openehealth.ipf.commons.xml.XsdValidator.createResource(XsdValidator.java:116) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        at org.openehealth.ipf.commons.xml.XsdValidator.createResource(XsdValidator.java:42) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        at org.openehealth.ipf.commons.xml.AbstractCachingXmlProcessor$1.load(AbstractCachingXmlProcessor.java:144) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        at org.openehealth.ipf.commons.xml.AbstractCachingXmlProcessor$Loader.get(AbstractCachingXmlProcessor.java:59) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        at org.openehealth.ipf.commons.xml.AbstractCachingXmlProcessor.resource(AbstractCachingXmlProcessor.java:147) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        at org.openehealth.ipf.commons.xml.XsdValidator.doValidate(XsdValidator.java:81) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        ... 34 common frames omitted
Caused by: org.xml.sax.SAXParseException; systemId: jar:nested:/D:/my-app/target/my-app-1.jar/!BOOT-INF/classes/!/schema/sts.xsd; lineNumber: 7; columnNumber: 116; schema_reference: Failed to read schema document 'ihe-appc-xacml-hl7-datatypes-base-1.0-epr-20211018.xsd', because 'nested' access is not allowed due to restriction set by the accessExternalSchema property.
        at java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:204) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.fatalError(ErrorHandlerWrapper.java:178) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(XMLErrorReporter.java:400) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.reportSchemaErr(XSDHandler.java:4256) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.reportSchemaFatalError(XSDHandler.java:4235) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.getSchemaDocument(XSDHandler.java:2221) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.resolveSchema(XSDHandler.java:2130) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.constructTrees(XSDHandler.java:1051) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler.parseSchema(XSDHandler.java:653) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaLoader.loadSchema(XMLSchemaLoader.java:618) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaLoader.loadGrammar(XMLSchemaLoader.java:577) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaLoader.loadGrammar(XMLSchemaLoader.java:543) ~[na:na]
        at java.xml/com.sun.org.apache.xerces.internal.jaxp.validation.XMLSchemaFactory.newSchema(XMLSchemaFactory.java:279) ~[na:na]
        at java.xml/javax.xml.validation.SchemaFactory.newSchema(SchemaFactory.java:613) ~[na:na]
        at org.openehealth.ipf.commons.xml.XsdValidator.createResource(XsdValidator.java:114) ~[ipf-commons-xml-6.0.0.jar!/:6.0.0]
        ... 39 common frames omitted

In XmlSecurity, LOCAL_ACCESS_ONLY whitelists the protocols allowed for loading schemas. It allows 'file:' and 'jar:', but prevents using 'nested:' which is required when IPF's JAR is nested in another application's JAR.
@ohr ohr self-assigned this Oct 13, 2026
@ohr ohr added the bug label Oct 13, 2026
@ohr
ohr merged commit 7db41d6 into oehf:master Oct 13, 2026
5 of 6 checks passed
@qligier
qligier deleted the fix/fat-jar-xml-security branch October 14, 2026 06:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants