Postgres Pro
Downloads
Home   >   mailing lists

Thread: [pgjdbc/pgjdbc] 7ef93f: refactor: Clean up whitespace in existingPgSQLXML...

[pgjdbc/pgjdbc] 7ef93f: refactor: Clean up whitespace in existingPgSQLXML...

From
Dave Cramer
Date:
  Branch: refs/tags/v42.2.13-rc1
  Home:   https://github.com/pgjdbc/pgjdbc
  Commit: 7ef93fb52ddd4614ceb7af89d86af28cb0f16b72
      https://github.com/pgjdbc/pgjdbc/commit/7ef93fb52ddd4614ceb7af89d86af28cb0f16b72
  Author: Sehrope Sarkuni <sehrope@jackdb.com>
  Date:   2020-05-23 (Sat, 23 May 2020)

  Changed paths:
    M pgjdbc/src/test/java/org/postgresql/jdbc/PgSQLXMLTest.java

  Log Message:
  -----------
  refactor: Clean up whitespace in existing PgSQLXMLTest


  Commit: 40af8d29862edfe5dffa0cf146dc211f4cc2b535
      https://github.com/pgjdbc/pgjdbc/commit/40af8d29862edfe5dffa0cf146dc211f4cc2b535
  Author: Sehrope Sarkuni <sehrope@jackdb.com>
  Date:   2020-05-23 (Sat, 23 May 2020)

  Changed paths:
    M pgjdbc/src/main/java/org/postgresql/PGProperty.java
    M pgjdbc/src/main/java/org/postgresql/core/BaseConnection.java
    M pgjdbc/src/main/java/org/postgresql/jdbc/PgConnection.java
    M pgjdbc/src/main/java/org/postgresql/jdbc/PgSQLXML.java
    A pgjdbc/src/main/java/org/postgresql/xml/DefaultPGXmlFactoryFactory.java
    A pgjdbc/src/main/java/org/postgresql/xml/EmptyStringEntityResolver.java
    A pgjdbc/src/main/java/org/postgresql/xml/LegacyInsecurePGXmlFactoryFactory.java
    A pgjdbc/src/main/java/org/postgresql/xml/NullErrorHandler.java
    A pgjdbc/src/main/java/org/postgresql/xml/PGXmlFactoryFactory.java
    M pgjdbc/src/test/java/org/postgresql/jdbc/PgSQLXMLTest.java

  Log Message:
  -----------
  fix: Fix XXE vulnerability in PgSQLXML by disabling external access and doctypes

Fixes XXE vulnerability by defaulting to disabling external access and doc types. The
legacy insecure behavior can be restored via the new connection property xmlFactoryFactory
with a value of LEGACY_INSECURE. Alternatively, a custom class name can be specified that
implements org.postgresql.xml.PGXmlFactoryFactory and takes a no argument constructor.


  Commit: c6b3cd5468c93068c5b528773ca990b9f0b29a1a
      https://github.com/pgjdbc/pgjdbc/commit/c6b3cd5468c93068c5b528773ca990b9f0b29a1a
  Author: Dave Cramer <davecramer@gmail.com>
  Date:   2020-05-27 (Wed, 27 May 2020)

  Changed paths:
    M gradle.properties

  Log Message:
  -----------
  release 42.2.13


Compare: https://github.com/pgjdbc/pgjdbc/compare/7ef93fb52ddd%5E...c6b3cd5468c9