Embed Xerces 2.12.2 in the XML connector instead of 2.6.2

[vharseko]

The XML connector bundle embeds xercesImpl-2.6.2.jar (2004). Trivy flags it in both the 2.1.0-SNAPSHOT build and the released 2.0.4 image with CVE-2012-0881 and CVE-2013-4002 (high, DoS while parsing XML), both fixed in 2.12.0. Code scanning alerts #1857, #1858, #1811, #1812.

Where 2.6.2 comes from

jaxen:1.1.1 (provided) depends on xercesImpl:2.6.2, and openicf.osgi.embed lists xercesImpl. Embed-Dependency has no scope filter there, so the transitive provided artifact is copied into lib/.

jaxen itself is unused: no class in the connector references org.jaxen, and neither does any other jar embedded in lib/ (Saxon-HE, xsom, xercesImpl, xml-apis, stax-api, relaxngDatatype). jaxen 1.1.1 has no META-INF/services, so nothing discovers it as a provider either. Its only effect was to put a 2007 jar in lib/ and pull in xercesImpl 2.6.2.

Xerces, on the other hand, is the parser the connector actually uses: XMLHandlerImpl calls DocumentBuilderFactory.newInstance() under the bundle's child-first class loader, which takes xml-apis, Xerces and Saxon from the bundle's lib/ (see XMLConnectorBundleIT).

Change

• jaxen is removed from the dependencies and from openicf.osgi.embed.
• xercesImpl 2.12.2 is declared directly. It has to be: without it Xerces would vanish from lib/, DocumentBuilderFactory.newInstance() would fall back to the JDK's internal Xerces, and the tests that import org.apache.xerces.* (XercesNodeLists, XMLHandlerReloadTests) would no longer compile.
• xml-apis 1.3.04 → 1.4.01, the version xercesImpl 2.12.2 depends on.

The bundle's lib/ now holds Saxon-HE-9.4.0.7, relaxngDatatype-20020414, stax-api-1.0-2, xercesImpl-2.12.2, xml-apis-1.4.01 and xsom-20070407; Import-Package no longer mentions jaxen or its optional dom4j/jdom/xom packages. No other bundle in the distribution embeds Xerces.

Tests

• xml-connector unit tests: 227, 0 failures. They include the XML connector: every operation reparses and rewrites the whole file, and DOM walks take O(N²) #157 tests that read Xerces internals through reflection (XercesNodeLists: CoreDocumentImpl.fFreeNLCache, ParentNode.fNodeListCache) and assert that the loaded document is not a DeferredDocumentImpl; those fields and classes are unchanged in 2.12.2.
• XMLConnectorBundleIT (packaged bundle under the child-first loader: create, update, Saxon filter search, authenticate, delete, reload after an outside edit): passes.

[maximthomas]

Suggestion: drop jaxen instead of overriding the Xerces version it brings in.

jaxen is unused. No class in the connector references org.jaxen, and neither does any other jar embedded in lib/ (Saxon-HE, xsom, xercesImpl, xml-apis, stax-api, relaxngDatatype). I checked the bytecode of the packaged bundle. Git history has no org.jaxen reference either. Its only effect is to put a 2007 jar in lib/ and pull in xercesImpl 2.6.2.

Bumping jaxen is not enough on its own. In 1.1.6 and 1.2.0 xercesImpl is provided, and 2.0.0 does not depend on it at all. Xerces would then vanish from lib/, DocumentBuilderFactory.newInstance() would fall back to the JDK's internal Xerces, and the tests that import org.apache.xerces.* (XercesNodeLists, XMLHandlerReloadTests) would no longer compile. So the direct xercesImpl 2.12.2 dependency added here is needed either way.

Proposed change on top of this PR:

• remove the jaxen dependency;
• remove jaxen from openicf.osgi.embed;
• reword the comment above xercesImpl. Once jaxen is gone, the reason to declare it is that this parser is what the connector uses at runtime and what the tests rely on, not that it overrides jaxen's version.

Verified locally on this branch with jaxen removed (mvn verify in OpenICF-xml-connector):

• unit tests: 227 run, 0 failures, 0 errors;
• XMLConnectorBundleIT: passes;
• bundle lib/: Saxon-HE-9.4.0.7, relaxngDatatype-20020414, stax-api-1.0-2, xercesImpl-2.12.2, xml-apis-1.4.01, xsom-20070407, with no jaxen.

[vharseko]

Applied in b35a626: jaxen is removed from the dependencies and from openicf.osgi.embed, and the comment above xercesImpl now gives the runtime/test reason instead of the jaxen override.

Rechecked locally: no org/jaxen references in the connector or in the embedded jars, and jaxen 1.1.1 has no META-INF/services; 227 unit tests and XMLConnectorBundleIT pass; lib/ and Import-Package match your list. The branch is also rebased onto current master.

The PR description is updated accordingly. The 228 it used to give included XMLConnectorBundleIT, which a -Dtest run picks up into surefire; the unit test count is 227.

[maximthomas]

LGTM