Enable FEATURE_SECURE_PROCESSING XML setting by default in 3.x

[trentdm]

Impact

• Bug fix (non-breaking change which fixes expected existing functionality)
• Enhancement/New feature (adds functionality without impacting existing logic)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

Backport security fix for CVE-2022-0839.

This change mirrors work done in #2384. It is intended to bring the same security fix to Liquibase's 3.x family of releases.

[Antehz]

Hello, I'd like to know when you're going to merge it, we're really waiting for this fix! Thanks!

[kataggart]

@Antehz we do not typically backport fixes to older versions, so unfortunately at this time we don't have resources to prioritize this request. Are you able to instead upgrade to one of the more recent Liquibase versions that includes the fix? Thanks.

[scott-jackman]

@Antehz we do not typically backport fixes to older versions, so unfortunately at this time we don't have resources to prioritize this request. Are you able to instead upgrade to one of the more recent Liquibase versions that includes the fix? Thanks.

This issue (#2248) is preventing us from upgrading to the more recent Liquibase versions. Do you have an ETA for when the threading issue will be resolved?

[kataggart]

@scott-jackman thanks for that backgound; I don't have a timeline right now, but your input helps us prioritize #2248. Thanks!

[westse]

@kataggart Thanks for prioritizing #2248 , that will also unblock us from upgrading. That said, would you consider an exception here to backporting the this fix to help us expedite addressing GHSA-jvfv-hrrc-6q72? The changes appear to affect nothing unless one opts in via property. And there is even a great test!

Anyway, thanks for considering.

[kataggart]

@westse Right not it is not likely, but I will raise it with the team tomorrow and see what they say. Other option is of course fork Liquibase on your side and apply your fix, build it and run with that until #2248 is resolved.

[nvoxland]

Closing this since #2248 has been resolved and released, and we are not going to be releasing more 3.x versions.