From e25bd8b2d836968bd136703a98dac00b0983be03 Mon Sep 17 00:00:00 2001 From: Quentin Ligier Date: Tue, 13 Oct 2026 15:04:19 +0200 Subject: [PATCH] Allow access to schemas in nested JARs In XmlSecurity, LOCAL_ACCESS_ONLY whitelists the protocols allowed for loading schemas. It allows 'file:' and 'jar:', but prevents using 'nested:' which is required when IPF's JAR is nested in another application's JAR. --- .../java/org/openehealth/ipf/commons/xml/XmlSecurity.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/commons/xml/src/main/java/org/openehealth/ipf/commons/xml/XmlSecurity.java b/commons/xml/src/main/java/org/openehealth/ipf/commons/xml/XmlSecurity.java index e4ab1bffe4..ce04bd9a8e 100644 --- a/commons/xml/src/main/java/org/openehealth/ipf/commons/xml/XmlSecurity.java +++ b/commons/xml/src/main/java/org/openehealth/ipf/commons/xml/XmlSecurity.java @@ -48,9 +48,10 @@ public class XmlSecurity { /** * Protocols still allowed when compiling schemas: enough to follow {@code xs:import} and - * {@code xs:include} to a sibling file or to a resource inside a jar, but not over the network. + * {@code xs:include} to a sibling file or to a resource inside a jar/fat jar (a jar in a jar), but not + * over the network. */ - private static final String LOCAL_ACCESS_ONLY = "file,jar"; + private static final String LOCAL_ACCESS_ONLY = "file,jar,nested"; /** * Hardens schema compilation. Schemas are trusted classpath resources, so this is defense in