[XSDLookUp] Updated entity resolver to not fallback to network lookup…

… when xsd is not found
liquibase · Feb 19, 2022 · 1c063b2 · 1c063b2
1 parent 6cdea2e
commit 1c063b2
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 2 deletions.
diff --git a/liquibase-core/src/main/java/liquibase/parser/core/xml/LiquibaseEntityResolver.java b/liquibase-core/src/main/java/liquibase/parser/core/xml/LiquibaseEntityResolver.java
@@ -1,8 +1,11 @@
 package liquibase.parser.core.xml;
 
+import liquibase.GlobalConfiguration;
 import liquibase.Scope;
 import liquibase.logging.Logger;
-import liquibase.resource.*;
+import liquibase.resource.ClassLoaderResourceAccessor;
+import liquibase.resource.InputStreamList;
+import liquibase.resource.ResourceAccessor;
 import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
 import org.xml.sax.ext.EntityResolver2;
@@ -18,6 +21,8 @@ public class LiquibaseEntityResolver implements EntityResolver2 {
 
     private static ClassLoaderResourceAccessor fallbackResourceAccessor;
 
+    private final boolean ALLOW_NETWORK_LOOKUP = false;
+
     @Override
     @java.lang.SuppressWarnings("squid:S2095")
     public InputSource resolveEntity(String name, String publicId, String baseURI, String systemId) throws SAXException, IOException {
@@ -40,7 +45,13 @@ public InputSource resolveEntity(String name, String publicId, String baseURI, S
         if (streams.isEmpty()) {
             streams = getFallbackResourceAccessor().openStreams(null, path);
 
-            if (streams.isEmpty()) {
+            if (streams.isEmpty() && GlobalConfiguration.SECURE_PARSING.getCurrentValue()) {
+                String errorMessage = "Unable to resolve xml entity locally : " +
+                        path +
+                        "\nGlobalConfiguration.SECURE_PARSING is set to true which only checks for locally packaged xsd files with liquibase." +
+                        "\nPlease set the flag to FALSE to allow remote lookups for xsd.";
+                throw new XSDLookUpException(errorMessage);
+            } else {
                 log.fine("Unable to resolve XML entity locally. Will load from network.");
                 return null;
             }

diff --git a/liquibase-core/src/main/java/liquibase/parser/core/xml/XSDLookUpException.java b/liquibase-core/src/main/java/liquibase/parser/core/xml/XSDLookUpException.java
@@ -0,0 +1,9 @@
+package liquibase.parser.core.xml;
+
+public class XSDLookUpException extends RuntimeException{
+
+    public XSDLookUpException(String message) {
+        super(message);
+    }
+
+}