The GitHub Actions job "CI" on grails-core.git/grails8-groovy6-canary has 
failed.
Run started by GitHub user jamesfredley (triggered by jamesfredley).

Head commit for run:
a092b13f2f53e03db32a5bba8b48b337ae742699 / James Fredley 
<[email protected]>
fix(testing-http-client): correct XmlUtils secure-slurper feature URIs and 
block external entities loudly

XmlUtils declared the SAX/Xerces feature identifiers with an https scheme
(https://apache.org/xml/features/..., https://xml.org/sax/features/...). The 
parser matches these
by exact string, so setFeature threw SAXNotRecognizedException for each and the 
catch block
swallowed it, leaving the parser at JDK defaults. On JDK 21/25 the 
FEATURE_SECURE_PROCESSING
default disallows DOCTYPE entirely, so XmlUtilsSpec / TestHttpResponseSpec 
failed: an inline
DOCTYPE with internal entities was rejected ("DOCTYPE is disallowed ...").

- Correct the identifiers to the http scheme so they are actually applied; 
disallow-doctype-decl is
  now explicitly false, so inline DOCTYPE with internal entities parses.
- Leave external general entities enabled and instead block them via the JAXP 
accessExternalDTD /
  accessExternalSchema properties (set to ""), so a SYSTEM reference is 
attempted and then blocked
  with a thrown SAXParseException ("External Entity: ... access is not 
allowed") instead of being
  silently dropped (external-general-entities=false skips without throwing). 
Net external access is
  still fully blocked - it now fails loud, matching the specs.

Verified on Groovy 6.0.0-SNAPSHOT: :grails-testing-support-http-client:test 
(103 tests) and
:grails-testing-support-http-client:codeStyle are green.

Assisted-by: claude-code:claude-4.8-opus

Report URL: https://github.com/apache/grails-core/actions/runs/26657743181

With regards,
GitHub Actions via GitBox

Reply via email to