Stefan Grönke
0e2aaa9c74
Harden repository containment check in RelativeUriResolver
...
The containment check compared raw URI strings with startsWith(). Percent-encoded dot segments survive URI.resolve() undecoded but are decoded when the file is opened, and a plain prefix match also accepts sibling directories sharing the repository name.
Compare decoded, normalized paths instead: file URIs via java.nio.file.Path, jar URIs by jar file and entry part, other schemes after normalization on a path segment boundary. Unmappable inputs fail closed.
This is defense-in-depth hardening, not a security fix: resource locations come from the pinned validation configuration, and documents under validation cannot influence resolution. Regression tests cover encoded traversal, the sibling prefix case, and cross-scheme references.
2026-07-24 11:33:37 +00:00
Renzo Kottmann
86d9ddfa2b
Merge branch 'release/1.6.x' into 'main'
...
Release/1.6.2
See merge request kosit/validator!110
2026-02-17 16:57:40 +01:00
Renzo Kottmann
955d608f56
[maven-release-plugin] prepare for next development iteration
2026-02-17 16:43:17 +01:00
Renzo Kottmann
1572ea34e9
[maven-release-plugin] prepare release v1.6.2
2026-02-17 16:42:55 +01:00
Renzo Kottmann
e7a64227a2
Merge branch 'release/1.6.x' of https://projekte.kosit.org/kosit/validator into release/1.6.x
2026-02-17 16:28:21 +01:00
Philip Helger
a52bab4c69
Updated changelog for 1.6.2
2026-02-17 16:20:30 +01:00
Philip Helger
20c2ce71c1
Added license in addition to #180
2026-02-17 16:20:30 +01:00
Philip Helger
752ceb228d
Resolve "Improve provided licenses in standalone JAR (Github 173)"
2026-02-17 16:20:30 +01:00
Philip Helger
c5c40c2009
Fixing Maven Assembly Output contains wrong XML Resolver JAR
2026-02-17 16:20:30 +01:00
Philip Helger
57ae444857
Update Validator 1.6.x dependencies to the latest versions
2026-02-17 16:20:30 +01:00
Philip Helger
1f5d79c027
Merge branch '178-maven-assembly-output-contains-wrong-jar' into 'release/1.6.x'
...
Resolve "Maven Assembly Output contains wrong JAR"
See merge request kosit/validator!106
2026-02-10 17:01:07 +01:00
Philip Helger
1fe8159c2b
Fixing Maven Assembly Output contains wrong XML Resolver JAR
2026-02-10 17:01:07 +01:00
Philip Helger
2a3a099058
Merge branch '179-update-1-6-dependencies-to-the-latest-versions' into 'release/1.6.x'
...
Resolve "Update 1.6 dependencies to the latest versions"
See merge request kosit/validator!107
2026-02-10 16:55:47 +01:00
Philip Helger
44c455ba86
Update Validator 1.6.x dependencies to the latest versions
2026-02-10 16:55:47 +01:00
Philip Helger
82fdcabe3d
Merge branch 'release/1.6.x' into 'main'
...
1.6.1 Release
See merge request kosit/validator!105
2026-02-05 12:53:43 +01:00
Renzo Kottmann
03e5be34b8
[maven-release-plugin] prepare for next development iteration
2026-02-05 12:25:33 +01:00
Renzo Kottmann
3b4765e9c1
[maven-release-plugin] prepare release v1.6.1
2026-02-05 12:25:11 +01:00
Philip Helger
06f6a77648
Merged
2026-02-05 11:57:42 +01:00
Philip Helger
cd1494747a
Removed "Unreleased"
2026-02-05 11:52:06 +01:00
Philip Helger
a3fd64c946
Prepared for release
2026-02-05 11:52:06 +01:00
Philip Helger
7bd423c458
Resolve "Wrong Schematron/XSLTs lead to positive validation result (GitHub 165)"
2026-02-05 11:52:06 +01:00
Philip Helger
155d3dc692
Added changelog for #106
2026-02-05 11:52:06 +01:00
Philip Helger
e2c3f5eea3
Resolve "scenario.xsd: Match Element darf nicht leer sein"
2026-02-05 11:52:06 +01:00
Philip Helger
53f16f5199
Fix/owasp oom
2026-02-05 11:52:06 +01:00
Philip Helger
f43f0d32ac
Resolve "Question: does the "standalone" JAR need to be in the assembly ZIP?"
2026-02-05 11:51:32 +01:00
Philip Helger
c29dd78b48
Resolve "Maven Central pom.xml is dependency-reduced"
2026-02-05 11:51:32 +01:00
Philip Helger
9f25e20108
Owasp using Java 21
2025-11-14 10:25:33 +01:00
Renzo Kottmann
938c87112d
Merge branch 'release/1.6.x' into 'main'
...
Updated API code snippet in readme for GitHub #117
See merge request kosit/validator!89
2025-11-07 15:24:07 +01:00
Philip Helger
f482d4d213
Updated API code snippet in readme for GitHub #117
2025-11-07 15:24:06 +01:00
Philip Helger
0e944616a5
Merge branch 'release/1.6.x' into 'main'
...
Update links to source code to current locations
See merge request kosit/validator!88
2025-11-07 13:00:53 +01:00
Renzo Kottmann
29766cf34b
chore: Minor correction
2025-11-07 11:17:32 +01:00
Renzo Kottmann
091c2c643c
Add Unreleased section to Changelog
2025-11-07 11:17:06 +01:00
Renzo Kottmann
535d88c829
[maven-release-plugin] prepare for next development iteration
2025-11-06 13:32:55 +01:00
Renzo Kottmann
f338f5f5f5
[maven-release-plugin] prepare release v1.6.0
2025-11-06 13:32:47 +01:00
Renzo Kottmann
32bec7c749
chore: add release date for 1.6.0 to Changelog
2025-11-06 13:23:14 +01:00
Renzo Kottmann
bbe93c965c
Merge branch 'release/1.6.x' of https://projekte.kosit.org/kosit/validator into release/1.6.x
2025-11-05 18:34:11 +01:00
Renzo Kottmann
9601f921e5
chore: bump exec plugin to 3.6.2, use successCode for broken daemon shutdown
2025-11-05 18:32:34 +01:00
Renzo Kottmann
f412f72110
chore: bump exec plugin to 3.6.2, use successCode for broken daemon shutdown
2025-11-05 18:31:08 +01:00
Philip Helger
53a967f4a8
Official images
2025-11-05 14:01:29 +01:00
Philip Helger
140b6d009d
Re-added Java 25
2025-11-05 13:55:49 +01:00
Philip Helger
f2d77b01e9
Version bump
2025-11-05 13:51:41 +01:00
Renzo Kottmann
6524c07631
Merge branch 'cleansing-ph-1.6' into 'release/1.6.x'
...
Replaced deprecated methods etc.
See merge request kosit/validator!77
2025-10-24 12:27:20 +02:00
Philip Helger
0b22c3ea91
Replaced deprecated methods etc.
2025-10-24 12:27:20 +02:00
Philip Helger
c030aaff02
Back to 24
2025-10-22 16:02:20 +02:00
Philip Helger
70f6026196
Add Java 25 instead of 24
2025-10-22 15:57:36 +02:00
Philip Helger
1da41a718f
Enforcing specific Java versions for compilation
2025-10-22 15:54:07 +02:00
Philip Helger
be9dcaac03
Using release instead of source/target
2025-10-22 15:37:21 +02:00
Philip Helger
e6d537f78a
Merge branch 'release/1.6.x' of https://projekte.kosit.org/kosit/validator.git into release/1.6.x
2025-10-22 15:33:37 +02:00
Philip Helger
9774dddb17
Lombok update for Java 25
2025-10-22 15:33:29 +02:00
Renzo Kottmann
1c5c3ab66f
Add github #127 to changelog.md
2025-10-22 15:19:06 +02:00
