This is an automated email from the ASF dual-hosted git repository. ilgrosso pushed a commit to branch 4_1_X in repository https://gitbox.apache.org/repos/asf/syncope.git
commit ae65c20476522634d8ebe6503a8172cedd1697f9 Author: Francesco Chicchiriccò <[email protected]> AuthorDate: Sat Oct 10 08:10:57 2026 +0200 flowable:expression is not needed --- .../core/flowable/impl/FlowableDeployUtils.java | 44 +++++++++++++++++++--- .../syncope/core/logic/init/FlowableLoader.java | 4 +- 2 files changed, 39 insertions(+), 9 deletions(-) diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableDeployUtils.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableDeployUtils.java index 4c087a6c99..08e6d0303f 100644 --- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableDeployUtils.java +++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableDeployUtils.java @@ -18,12 +18,16 @@ */ package org.apache.syncope.core.flowable.impl; +import static org.flowable.bpmn.constants.BpmnXMLConstants.ATTRIBUTE_TASK_SERVICE_EXPRESSION; +import static org.flowable.bpmn.constants.BpmnXMLConstants.FLOWABLE_EXTENSIONS_NAMESPACE; + import com.fasterxml.jackson.databind.json.JsonMapper; import com.fasterxml.jackson.databind.node.ObjectNode; import java.io.ByteArrayInputStream; +import java.io.IOException; import java.io.InputStream; -import java.io.InputStreamReader; import javax.xml.stream.XMLInputFactory; +import javax.xml.stream.XMLStreamConstants; import javax.xml.stream.XMLStreamException; import javax.xml.stream.XMLStreamReader; import org.apache.syncope.core.workflow.api.WorkflowException; @@ -48,12 +52,41 @@ public final class FlowableDeployUtils { XML_INPUT_FACTORY.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE); } + private static boolean containsExpression(final byte[] xml) throws XMLStreamException, IOException { + try (ByteArrayInputStream in = new ByteArrayInputStream(xml)) { + XMLStreamReader xtr = XML_INPUT_FACTORY.createXMLStreamReader(in); + try { + while (xtr.hasNext()) { + if (xtr.next() == XMLStreamConstants.START_ELEMENT) { + for (int i = 0; i < xtr.getAttributeCount(); i++) { + if (FLOWABLE_EXTENSIONS_NAMESPACE.equals(xtr.getAttributeNamespace(i)) + && ATTRIBUTE_TASK_SERVICE_EXPRESSION.equals(xtr.getAttributeLocalName(i))) { + + return true; + } + } + } + } + return false; + } finally { + xtr.close(); + } + } + } + public static Deployment deployDefinition( final ProcessEngine engine, final String resourceName, final byte[] definition) { try { - return engine.getRepositoryService().createDeployment(). - addInputStream(resourceName, new ByteArrayInputStream(definition)).deploy(); + if (containsExpression(definition)) { + throw new WorkflowException("Attribute flowable:expression is not allowed"); + } + } catch (IOException | XMLStreamException e) { + throw new WorkflowException("While checking " + resourceName, e); + } + + try { + return engine.getRepositoryService().createDeployment().addBytes(resourceName, definition).deploy(); } catch (FlowableException e) { throw new WorkflowException("While importing " + resourceName, e); } @@ -62,10 +95,9 @@ public final class FlowableDeployUtils { public static void deployModel(final ProcessEngine engine, final ProcessDefinition procDef) { XMLStreamReader xtr = null; try (InputStream bpmnStream = engine.getRepositoryService(). - getResourceAsStream(procDef.getDeploymentId(), procDef.getResourceName()); - InputStreamReader isr = new InputStreamReader(bpmnStream)) { + getResourceAsStream(procDef.getDeploymentId(), procDef.getResourceName())) { - xtr = XML_INPUT_FACTORY.createXMLStreamReader(isr); + xtr = XML_INPUT_FACTORY.createXMLStreamReader(bpmnStream); BpmnModel bpmnModel = new BpmnXMLConverter().convertToBpmnModel(xtr); Model model = engine.getRepositoryService().newModel(); diff --git a/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/init/FlowableLoader.java b/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/init/FlowableLoader.java index 83376a3a1c..8d18986a52 100644 --- a/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/init/FlowableLoader.java +++ b/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/init/FlowableLoader.java @@ -18,7 +18,6 @@ */ package org.apache.syncope.core.logic.init; -import java.io.ByteArrayInputStream; import java.io.IOException; import java.io.InputStream; import java.util.List; @@ -79,8 +78,7 @@ public class FlowableLoader implements SyncopeCoreLoader { // Only loads process definition from file if not found in repository if (processes.isEmpty()) { - processEngine.getRepositoryService().createDeployment().addInputStream( - userWorkflowDef.getFilename(), new ByteArrayInputStream(wfDef)).deploy(); + FlowableDeployUtils.deployDefinition(processEngine, userWorkflowDef.getFilename(), wfDef); ProcessDefinition procDef = processEngine.getRepositoryService().createProcessDefinitionQuery(). processDefinitionKey(FlowableRuntimeUtils.WF_PROCESS_ID).latestVersion().
