Merge pull request #739 from marklogic/feature/21542-more-polaris

rjrudin · web-flow · commit 9857f51f97bd · 2025-05-22T13:55:38.000-04:00
MLE-21542 More Polaris fixes
diff --git a/ml-app-deployer/src/main/java/com/marklogic/appdeployer/command/forests/ForestBuilder.java b/ml-app-deployer/src/main/java/com/marklogic/appdeployer/command/forests/ForestBuilder.java
@@ -55,7 +55,7 @@ public ForestBuilder(ForestNamingStrategy forestNamingStrategy) {
 	 * @param appConfig
 	 * @return
 	 */
-	public List<Forest> buildForests(ForestPlan forestPlan, AppConfig appConfig) {
+	public List<Forest> buildForests(ForestPlan forestPlan, final AppConfig appConfig) {
 		final String databaseName = forestPlan.getDatabaseName();
 		Objects.requireNonNull(databaseName);
 		Objects.requireNonNull(appConfig);
@@ -85,6 +85,7 @@ public List<Forest> buildForests(ForestPlan forestPlan, AppConfig appConfig) {
 				for (int i = 0; i < forestsToCreate; i++) {
 					forestCounter++;
 					Forest forest = newForest(forestPlan);
+					Objects.requireNonNull(forest);
 					forest.setForestName(getForestName(databaseName, forestCounter, appConfig));
 					forest.setHost(hostName);
 					forest.setDatabase(databaseName);
diff --git a/ml-app-deployer/src/main/java/com/marklogic/mgmt/resource/forests/ForestManager.java b/ml-app-deployer/src/main/java/com/marklogic/mgmt/resource/forests/ForestManager.java
@@ -26,8 +26,6 @@
 import com.marklogic.mgmt.resource.AbstractResourceManager;
 import com.marklogic.rest.util.Fragment;
 import com.marklogic.rest.util.XPathUtil;
-import org.springframework.http.HttpMethod;
-import org.springframework.web.util.UriComponentsBuilder;
 
 import java.util.ArrayList;
 import java.util.HashMap;
diff --git a/ml-app-deployer/src/main/java/com/marklogic/mgmt/resource/security/AmpManager.java b/ml-app-deployer/src/main/java/com/marklogic/mgmt/resource/security/AmpManager.java
@@ -24,7 +24,6 @@
 import com.marklogic.rest.util.XPathUtil;
 import org.springframework.http.ResponseEntity;
 
-import javax.xml.xpath.XPath;
 import java.util.ArrayList;
 import java.util.List;
 
diff --git a/ml-app-deployer/src/main/java/com/marklogic/rest/util/Fragment.java b/ml-app-deployer/src/main/java/com/marklogic/rest/util/Fragment.java
@@ -15,17 +15,15 @@
  */
 package com.marklogic.rest.util;
 
+import com.marklogic.client.ext.util.XmlUtil;
 import org.jdom2.Document;
 import org.jdom2.Element;
 import org.jdom2.Namespace;
 import org.jdom2.filter.Filters;
-import org.jdom2.input.SAXBuilder;
-import org.jdom2.input.sax.XMLReaders;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
 import org.jdom2.xpath.XPathExpression;
 import org.jdom2.xpath.XPathFactory;
-import org.xml.sax.InputSource;
 
 import java.io.StringReader;
 import java.util.ArrayList;
@@ -45,19 +43,7 @@ public Fragment(Fragment other) {
 
 	public Fragment(String xml, Namespace... namespaces) {
 		try {
-			SAXBuilder builder = new SAXBuilder(XMLReaders.NONVALIDATING);
-
-			// Prevent DTDs from being loaded
-			builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-
-			// Disable external entities
-			builder.setFeature("http://xml.org/sax/features/external-general-entities", false);
-			builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-
-			// Set a no-op EntityResolver to block external DTDs
-			builder.setEntityResolver((publicId, systemId) -> new InputSource(new StringReader("")));
-
-			internalDoc = builder.build(new StringReader(xml));
+			internalDoc = XmlUtil.newSAXBuilder().build(new StringReader(xml));
 			List<Namespace> list = new ArrayList<>();
 			list.add(Namespace.getNamespace("arp", "http://marklogic.com/manage/alert-rule/properties"));
 			list.add(Namespace.getNamespace("c", "http://marklogic.com/manage/clusters"));
diff --git a/ml-app-deployer/src/main/java/com/marklogic/rest/util/XPathUtil.java b/ml-app-deployer/src/main/java/com/marklogic/rest/util/XPathUtil.java
@@ -12,8 +12,8 @@ public abstract class XPathUtil {
 	 * @return
 	 */
 	public static String sanitizeValueForXPathExpression(String resourceIdOrName) {
-		// MarkLogic generally the following characters in a resource name, and we know an ID will never have them.
-		// Removing them avoids issues with XPath queries.
+		// MarkLogic generally prohibits the following characters in a resource name, and we know an ID will never
+		// have them. Removing them avoids issues with XPath injection attacks.
 		return resourceIdOrName != null ?
 			resourceIdOrName.replace("'", "").replace("\"", "").replace("[", "").replace("]", "") :
 			null;
diff --git a/ml-app-deployer/src/test/java/com/marklogic/junit/Fragment.java b/ml-app-deployer/src/test/java/com/marklogic/junit/Fragment.java
@@ -15,11 +15,11 @@
  */
 package com.marklogic.junit;
 
+import com.marklogic.client.ext.util.XmlUtil;
 import org.jdom2.Document;
 import org.jdom2.Element;
 import org.jdom2.Namespace;
 import org.jdom2.filter.Filters;
-import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
 import org.jdom2.xpath.XPathExpression;
@@ -51,7 +51,7 @@ public Fragment(Document doc) {
 
 	public Fragment(String xml, Namespace... namespaces) {
 		try {
-			internalDoc = new SAXBuilder().build(new StringReader(xml));
+			internalDoc = XmlUtil.newSAXBuilder().build(new StringReader(xml));
 			this.namespaces = namespaces;
 		} catch (Exception e) {
 			throw new RuntimeException(e);
diff --git a/ml-javaclient-util/src/main/java/com/marklogic/client/ext/es/EntityServicesManager.java b/ml-javaclient-util/src/main/java/com/marklogic/client/ext/es/EntityServicesManager.java
@@ -17,11 +17,11 @@
 
 import com.marklogic.client.DatabaseClient;
 import com.marklogic.client.document.GenericDocumentManager;
+import com.marklogic.client.ext.util.XmlUtil;
 import com.marklogic.client.io.BytesHandle;
 import com.marklogic.client.io.DocumentMetadataHandle;
 import org.jdom2.Element;
 import org.jdom2.Namespace;
-import org.jdom2.input.SAXBuilder;
 
 import java.io.StringReader;
 import java.util.Objects;
@@ -93,7 +93,7 @@ protected GeneratedCode initializeGeneratedCode(String modelUri) {
 		Objects.requireNonNull(output);
 		Element root;
 		try {
-			root = new SAXBuilder().build(new StringReader(output)).getRootElement();
+			root = XmlUtil.newSAXBuilder().build(new StringReader(output)).getRootElement();
 		} catch (Exception e) {
 			throw new RuntimeException("Unable to parse model XML: " + e.getMessage(), e);
 		}
diff --git a/ml-javaclient-util/src/main/java/com/marklogic/client/ext/modulesloader/impl/DefaultExtensionMetadataProvider.java b/ml-javaclient-util/src/main/java/com/marklogic/client/ext/modulesloader/impl/DefaultExtensionMetadataProvider.java
@@ -23,8 +23,8 @@
 import com.marklogic.client.ext.helper.LoggingObject;
 import com.marklogic.client.ext.modulesloader.ExtensionMetadataAndParams;
 import com.marklogic.client.ext.modulesloader.ExtensionMetadataProvider;
+import com.marklogic.client.ext.util.XmlUtil;
 import org.jdom2.Element;
-import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.XMLOutputter;
 import org.springframework.core.io.Resource;
 import org.springframework.core.io.support.PathMatchingResourcePatternResolver;
@@ -62,7 +62,7 @@ public ExtensionMetadataAndParams provideExtensionMetadataAndParams(Resource r)
         Resource metadataResource = resolver.getResource(metadataFile);
         if (metadataResource != null) {
             try {
-                Element root = new SAXBuilder().build(metadataResource.getInputStream()).getRootElement();
+                Element root = XmlUtil.newSAXBuilder().build(metadataResource.getInputStream()).getRootElement();
                 m.setTitle(root.getChildText("title"));
                 Element desc = root.getChild("description");
                 if (desc != null && desc.getChildren() != null && desc.getChildren().size() == 1) {
diff --git a/ml-javaclient-util/src/main/java/com/marklogic/client/ext/modulesloader/impl/DefaultModulesLoader.java b/ml-javaclient-util/src/main/java/com/marklogic/client/ext/modulesloader/impl/DefaultModulesLoader.java
@@ -28,10 +28,10 @@
 import com.marklogic.client.ext.helper.LoggingObject;
 import com.marklogic.client.ext.modulesloader.*;
 import com.marklogic.client.ext.tokenreplacer.TokenReplacer;
+import com.marklogic.client.ext.util.XmlUtil;
 import com.marklogic.client.io.Format;
 import com.marklogic.client.io.StringHandle;
 import org.jdom2.Element;
-import org.jdom2.input.SAXBuilder;
 import org.springframework.beans.factory.DisposableBean;
 import org.springframework.core.io.Resource;
 import org.springframework.core.task.SyncTaskExecutor;
@@ -319,7 +319,7 @@ protected void applyJsonProperties(ServerConfigurationManager mgr, Resource r, F
 	protected void applyXmlProperties(ServerConfigurationManager mgr, Resource r, File file) {
 		Element root;
 		try {
-			root = new SAXBuilder().build(r.getInputStream()).getRootElement();
+			root = XmlUtil.newSAXBuilder().build(r.getInputStream()).getRootElement();
 		} catch (Exception e) {
 			throw new RuntimeException("Unable to read XML REST properties file: " + file.getAbsolutePath(), e);
 		}
diff --git a/ml-javaclient-util/src/main/java/com/marklogic/client/ext/schemasloader/impl/QbvDocumentFileProcessor.java b/ml-javaclient-util/src/main/java/com/marklogic/client/ext/schemasloader/impl/QbvDocumentFileProcessor.java
@@ -22,12 +22,12 @@
 import com.marklogic.client.ext.file.DocumentFileProcessor;
 import com.marklogic.client.ext.helper.FilenameUtil;
 import com.marklogic.client.ext.helper.LoggingObject;
+import com.marklogic.client.ext.util.XmlUtil;
 import com.marklogic.client.extra.jdom.JDOMHandle;
 import com.marklogic.client.io.Format;
 import com.marklogic.client.io.StringHandle;
 import org.jdom2.Document;
 import org.jdom2.Element;
-import org.jdom2.input.SAXBuilder;
 import org.springframework.util.FileCopyUtils;
 
 import java.io.File;
@@ -99,7 +99,7 @@ private void processQbvFile(DocumentFile qbvFile) {
 			if (Format.XML.equals(handleString.getFormat())) {
 				Document xmlDocument;
 				try {
-					xmlDocument = new SAXBuilder().build(new StringReader(handleString.get()));
+					xmlDocument = XmlUtil.newSAXBuilder().build(new StringReader(handleString.get()));
 				} catch (Exception e) {
 					throw new RuntimeException(format("Query-Based View generation failed for file: %s; cause: %s", qbvFile.getFile().getAbsolutePath(), e.getMessage()));
 				}
diff --git a/ml-javaclient-util/src/main/java/com/marklogic/client/ext/schemasloader/impl/TdeDocumentFileProcessor.java b/ml-javaclient-util/src/main/java/com/marklogic/client/ext/schemasloader/impl/TdeDocumentFileProcessor.java
@@ -107,7 +107,7 @@ private void validateTdeTemplate(DocumentFile documentFile) {
 
 				if (call != null) {
 					ObjectNode node = (ObjectNode) call.evalAs(JsonNode.class);
-					if (node.has("valid") && node.get("valid").asBoolean()) {
+					if (node.has("valid") && node.get("valid") != null && node.get("valid").asBoolean()) {
 						logger.info("TDE template passed validation: " + file);
 					} else {
 						throw new RuntimeException(format("TDE template failed validation; file: %s; cause: %s", file, node.get("message").asText()));
diff --git a/ml-javaclient-util/src/main/java/com/marklogic/client/ext/ssl/SslUtil.java b/ml-javaclient-util/src/main/java/com/marklogic/client/ext/ssl/SslUtil.java
@@ -15,6 +15,7 @@
  */
 package com.marklogic.client.ext.ssl;
 
+import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import javax.net.ssl.SSLContext;
@@ -32,6 +33,8 @@ public abstract class SslUtil {
 	// clients connecting to MarkLogic 11 or older will default to TLSv1.2.
 	public final static String DEFAULT_SSL_PROTOCOL = "TLS";
 
+	private static final Logger LOGGER = LoggerFactory.getLogger(SslUtil.class);
+
 	/**
 	 * Configure an SSLContext and X509TrustManager with the default protocol and the default algorithm of
 	 * TrustManagerFactory.
@@ -57,7 +60,7 @@ public static SslConfig configureUsingTrustManagerFactory(String protocol, Strin
 		} catch (NoSuchAlgorithmException e) {
 			// Including this to make Polaris happy.
 			String message = String.format("Unable to instantiate SSLContext with protocol: %s; cause: %s", protocol, e.getMessage());
-			LoggerFactory.getLogger(SslUtil.class).error(message, e);
+			LOGGER.error(message, e);
 			throw new RuntimeException(message, e);
 		}
 
@@ -68,15 +71,18 @@ public static SslConfig configureUsingTrustManagerFactory(String protocol, Strin
 		try {
 			trustManagerFactory = TrustManagerFactory.getInstance(algorithm);
 		} catch (NoSuchAlgorithmException e) {
-			throw new RuntimeException("Unable to instantiate TrustManagerFactory, cause: " + e.getMessage(), e);
+			// Including this to make Polaris happy.
+			String message = String.format("Unable to instantiate TrustManagerFactory, cause: %s", e.getMessage());
+			LOGGER.error(message, e);
+			throw new RuntimeException(message, e);
 		}
 
 		try {
 			trustManagerFactory.init((KeyStore) null);
 		} catch (KeyStoreException e) {
 			// Including this to make Polaris happy.
 			String message = String.format("Unable to initialize TrustManagerFactory, cause: %s", e.getMessage());
-			LoggerFactory.getLogger(SslUtil.class).error(message, e);
+			LOGGER.error(message, e);
 			throw new RuntimeException(message, e);
 		}
 
@@ -97,7 +103,7 @@ public static SslConfig configureUsingTrustManagerFactory(String protocol, Strin
 		} catch (KeyManagementException e) {
 			// Including this to make Polaris happy.
 			String message = String.format("Unable to initialize SSLContext, cause: %s", e.getMessage());
-			LoggerFactory.getLogger(SslUtil.class).error(message, e);
+			LOGGER.error(message, e);
 			throw new RuntimeException(message, e);
 		}
 
diff --git a/ml-javaclient-util/src/main/java/com/marklogic/client/ext/util/XmlUtil.java b/ml-javaclient-util/src/main/java/com/marklogic/client/ext/util/XmlUtil.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright © 2025 MarkLogic Corporation. All Rights Reserved.
+ */
+package com.marklogic.client.ext.util;
+
+import org.jdom2.input.SAXBuilder;
+import org.jdom2.input.sax.XMLReaders;
+import org.xml.sax.InputSource;
+
+import java.io.StringReader;
+
+public abstract class XmlUtil {
+
+	public static SAXBuilder newSAXBuilder() {
+		SAXBuilder builder = new SAXBuilder(XMLReaders.NONVALIDATING);
+
+		// Prevent DTDs from being loaded
+		builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+
+		// Disable external entities
+		builder.setFeature("http://xml.org/sax/features/external-general-entities", false);
+		builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+
+		// Set a no-op EntityResolver to block external DTDs
+		builder.setEntityResolver((publicId, systemId) -> new InputSource(new StringReader("")));
+
+		return builder;
+	}
+	
+	private XmlUtil() {
+	}
+}
