Conversation
Test Results124 files + 1 124 suites +1 2m 15s ⏱️ +26s For more details on these failures, see this check. Results for commit be23f39. ± Comparison against base commit 9359d9a. ♻️ This comment has been updated with latest results. |
f041519 to
6a7ed4e
Compare
Signed-off-by: Mitch Gaffigan <mitch.gaffigan@comcast.net>
Signed-off-by: Mitch Gaffigan <mitch.gaffigan@comcast.net>
6a7ed4e to
be23f39
Compare
| hapi-structures-v27 = { module = "ca.uhn.hapi:hapi-structures-v27", version = "2.3" } | ||
| hapi-structures-v28 = { module = "ca.uhn.hapi:hapi-structures-v28", version = "2.3" } | ||
| hapi-structures-v281 = { module = "ca.uhn.hapi:hapi-structures-v281", version = "2.3" } | ||
| hapi-base = { module = "ca.uhn.hapi:hapi-base", version = "2.6.0" } |
There was a problem hiding this comment.
This upgrade introduces silent data loss for valid HL7 XML containing CDATA. Reproduced through OIE's ER7Serializer on Java 17 and 21, changing only the HAPI libraries:
<HD.1><![CDATA[clinical]]></HD.1>: HAPI 2.3 preservesclinical; 2.6.0 produces an empty MSH-3 field.<HD.1>before<![CDATA[clinical]]>after</HD.1>: 2.3 preservesbeforeclinicalafter; 2.6.0 returnsbeforeafter.
Both conversions report success. These inputs contain no DOCTYPE or external entity.
Affected paths are fromXML with strict parsing enabled (validation on or off), and toXML for XML input with strict parsing and validation both enabled. HAPI 2.6.0's XMLUtils.parseDocument uses a DOM builder without enabling coalescing, while XMLParser.parsePrimitive only appends text nodes, so CDATA nodes are discarded.
The targeted XXE fix works in the tested engine paths: baseline file disclosure and network requests were reproduced, and 2.6.0 prevented both for external entity and DTD payloads. Please preserve CDATA field contents while retaining those restrictions, and add regression coverage for pure and mixed CDATA on both affected paths before merging.
There was a problem hiding this comment.
Seems like an upstream bug. I agree with adding regression tests, but can someone get an upstream but open or linked?
2 participants
No description provided.