Skip to content

Commit d2684b3

Browse files
tonygermanotonygermano
committed
refactor: Remove Xerces/xml-apis dependencies and modernize SAX readers
Removes the dependency on `xercesImpl` and `xml-apis` to resolve classloader conflicts and reduce security risks in Java 17+ environments. Refactors custom Reader classes to use the standard JDK `XMLReader` interface instead of extending the Apache Xerces `SAXParser`. Changes: - **Dependency Removal:** Removed `xercesImpl` and `xml-apis` from the build configuration. - **New Base Class:** Introduced `AbstractXMLReader` to centralize common `XMLReader` logic (handler management, feature/property compliance) and reduce code duplication across plugins. - **Reader Refactoring:** Updated `DelimitedReader`, `EDIReader`, `ER7Reader`, and `NCPDPReader`: - Replaced inheritance (`extends SAXParser`) with `extends AbstractXMLReader`. - Added standard `parse(String)` overload via the base class. - Implemented strict SAX2 compliance for `getFeature`/`setFeature` to correctly report namespace support to downstream transformers. - **Code Cleanup:** Removed unused imports of `org.apache.xerces.parsers.SAXParser`. - **Documentation Cleanup:** Removed references to removed libraries in `THIRD-PARTY-README.txt` This change ensures the application uses the built-in JDK XML parser, reducing the artifact size and aligning with modern Java best practices. Signed-off-by: Tony Germano <tony@germano.name>
1 parent 8f103d6 commit d2684b3

File tree

12 files changed

+292
-131
lines changed

12 files changed

+292
-131
lines changed

‎client/.classpath‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,6 @@
122122
<classpathentry kind="lib" path="lib/xpp3-1.1.4c.jar"/>
123123
<classpathentry kind="lib" path="lib/commons-logging-1.2.jar"/>
124124
<classpathentry kind="lib" path="lib/looks-2.3.1.jar"/>
125-
<classpathentry kind="lib" path="lib/xercesImpl-2.12.2.jar"/>
126125
<classpathentry kind="lib" path="lib/commons-io-2.13.0.jar"/>
127126
<classpathentry kind="lib" path="lib/commons-lang3-3.13.0.jar">
128127
<attributes>
@@ -213,7 +212,6 @@
213212
<classpathentry kind="lib" path="lib/xstream-1.4.20.jar"/>
214213
<classpathentry kind="lib" path="lib/libphonenumber-8.12.50.jar"/>
215214
<classpathentry kind="lib" path="lib/commons-pool2-2.3.jar"/>
216-
<classpathentry kind="lib" path="lib/xml-apis-1.4.01.jar"/>
217215
<classpathentry kind="lib" path="lib/java-semver-0.10.2.jar"/>
218216
<classpathentry kind="output" path="bin"/>
219217
</classpath>

‎client/lib/xercesImpl-2.12.2.jar‎

-1.38 MB
Binary file not shown.

‎client/lib/xml-apis-1.4.01.jar‎

-215 KB
Binary file not shown.

‎server/.classpath‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -269,7 +269,5 @@
269269
<classpathentry kind="lib" path="lib/rhino-1.7.13.jar"/>
270270
<classpathentry kind="lib" path="lib/commons/commons-fileupload-1.5.jar"/>
271271
<classpathentry kind="lib" path="lib/xstream-1.4.20.jar"/>
272-
<classpathentry kind="lib" path="lib/xercesImpl-2.12.2.jar"/>
273-
<classpathentry kind="lib" path="lib/xml-apis-1.4.01.jar"/>
274272
<classpathentry kind="output" path="bin"/>
275273
</classpath>

‎server/docs/thirdparty/THIRD-PARTY-README.txt‎

Lines changed: 0 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -521,16 +521,6 @@ License: LGPL (dual-license with SPL)
521521
Use version 2.x as Xilize has a dependency on it; used only to produce
522522
documentation.
523523

524-
XML-APIs (extracted from Apache Xerces-2)
525-
http://xerces.apache.org/xerces2-j/
526-
License: Apache v2
527-
We include the xml-apis.jar from the Xerces binary distribution in order to allow
528-
our code to compile on JDK 1.4, which does not include newer XML APIs, even though
529-
these API implementations will run on version 1.4 of the JRE. The JAR is unmodified
530-
from the Xerces release, but is renamed as xml-apis-xerces-2.9.1.jar to
531-
make the version clear.
532-
Included as lib/xml-apis-xerces-2.9.1.jar
533-
534524
=================== End of License Information ===================
535525

536526

@@ -883,74 +873,6 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
883873
--------------------------------------------------------------------------------
884874

885875

886-
The license below pertains to Apache Xerces2 Java (Build Tools) version 2.9.1,
887-
which is included with Mirth Connect.
888-
889-
=================== Beginning of License ===================
890-
891-
/*
892-
* The Apache Software License, Version 1.1
893-
*
894-
*
895-
* Copyright (c) 1999-2002 The Apache Software Foundation. All rights
896-
* reserved.
897-
*
898-
* Redistribution and use in source and binary forms, with or without
899-
* modification, are permitted provided that the following conditions
900-
* are met:
901-
*
902-
* 1. Redistributions of source code must retain the above copyright
903-
* notice, this list of conditions and the following disclaimer.
904-
*
905-
* 2. Redistributions in binary form must reproduce the above copyright
906-
* notice, this list of conditions and the following disclaimer in
907-
* the documentation and/or other materials provided with the
908-
* distribution.
909-
*
910-
* 3. The end-user documentation included with the redistribution,
911-
* if any, must include the following acknowledgment:
912-
* "This product includes software developed by the
913-
* Apache Software Foundation (http://www.apache.org/)."
914-
* Alternately, this acknowledgment may appear in the software itself,
915-
* if and wherever such third-party acknowledgments normally appear.
916-
*
917-
* 4. The names "Xerces" and "Apache Software Foundation" must
918-
* not be used to endorse or promote products derived from this
919-
* software without prior written permission. For written
920-
* permission, please contact apache@apache.org.
921-
*
922-
* 5. Products derived from this software may not be called "Apache",
923-
* nor may "Apache" appear in their name, without prior written
924-
* permission of the Apache Software Foundation.
925-
*
926-
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
927-
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
928-
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
929-
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
930-
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
931-
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
932-
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
933-
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
934-
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
935-
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
936-
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
937-
* SUCH DAMAGE.
938-
* ====================================================================
939-
*
940-
* This software consists of voluntary contributions made by many
941-
* individuals on behalf of the Apache Software Foundation and was
942-
* originally based on software copyright (c) 1999, International
943-
* Business Machines, Inc., http://www.ibm.com. For more
944-
* information on the Apache Software Foundation, please see
945-
* <http://www.apache.org/>.
946-
*/
947-
948-
=================== End of License =========================
949-
950-
951-
--------------------------------------------------------------------------------
952-
953-
954876
The license below pertains to Jsch version 0.2.13, which is included with Mirth
955877
Connect.
956878

‎server/lib/xercesImpl-2.12.2.jar‎

-1.38 MB
Binary file not shown.

‎server/lib/xml-apis-1.4.01.jar‎

-215 KB
Binary file not shown.

‎server/src/com/mirth/connect/plugins/datatypes/delimited/DelimitedReader.java‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,6 @@
1-
/*
2-
* Copyright (c) Mirth Corporation. All rights reserved.
3-
*
4-
* http://www.mirthcorp.com
5-
*
6-
* The software in this package is published under the terms of the MPL license a copy of which has
7-
* been included with this distribution in the LICENSE.txt file.
8-
*/
1+
// SPDX-License-Identifier: MPL-2.0
2+
// SPDX-FileCopyrightText: Mirth Corporation
3+
// SPDX-FileCopyrightText: 2025 Tony Germano
94

105
package com.mirth.connect.plugins.datatypes.delimited;
116

@@ -16,14 +11,13 @@
1611
import org.apache.commons.lang3.StringUtils;
1712
import org.apache.logging.log4j.LogManager;
1813
import org.apache.logging.log4j.Logger;
19-
import org.apache.xerces.parsers.SAXParser;
20-
import org.xml.sax.ContentHandler;
14+
import org.openintegrationengine.engine.plugins.datatypes.AbstractXMLReader;
2115
import org.xml.sax.InputSource;
2216
import org.xml.sax.SAXException;
2317

2418
import com.mirth.connect.util.StringUtil;
2519

26-
public class DelimitedReader extends SAXParser {
20+
public class DelimitedReader extends AbstractXMLReader {
2721
private Logger logger = LogManager.getLogger(this.getClass());
2822

2923
private DelimitedSerializationProperties serializationProperties;
@@ -49,8 +43,10 @@ public DelimitedReader(DelimitedSerializationProperties serializationProperties)
4943
ungottenRawText = null;
5044
}
5145

46+
@Override
5247
public void parse(InputSource input) throws SAXException, IOException {
53-
48+
ensureHandlerSet();
49+
5450
// Parsing overview
5551
//
5652
// The incoming stream is a single message which is a collection of one
@@ -85,7 +81,6 @@ public void parse(InputSource input) throws SAXException, IOException {
8581

8682
// Start the document
8783
String documentHead = "delimited";
88-
ContentHandler contentHandler = getContentHandler();
8984
contentHandler.startDocument();
9085

9186
// Output <delimited>
@@ -118,7 +113,8 @@ public void parse(InputSource input) throws SAXException, IOException {
118113
contentHandler.startElement("", columnName, "", null);
119114

120115
// Output column value
121-
contentHandler.characters(record.get(i).toCharArray(), 0, record.get(i).length());
116+
String val = record.get(i);
117+
contentHandler.characters(val.toCharArray(), 0, val.length());
122118

123119
// Output </columnN>
124120
contentHandler.endElement("", columnName, "");

‎server/src/com/mirth/connect/plugins/datatypes/edi/EDIReader.java‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,6 @@
1-
/*
2-
* Copyright (c) Mirth Corporation. All rights reserved.
3-
*
4-
* http://www.mirthcorp.com
5-
*
6-
* The software in this package is published under the terms of the MPL license a copy of which has
7-
* been included with this distribution in the LICENSE.txt file.
8-
*/
1+
// SPDX-License-Identifier: MPL-2.0
2+
// SPDX-FileCopyrightText: Mirth Corporation
3+
// SPDX-FileCopyrightText: 2025 Tony Germano
94

105
package com.mirth.connect.plugins.datatypes.edi;
116

@@ -15,19 +10,17 @@
1510

1611
import org.apache.logging.log4j.LogManager;
1712
import org.apache.logging.log4j.Logger;
18-
import org.apache.xerces.parsers.SAXParser;
13+
import org.openintegrationengine.engine.plugins.datatypes.AbstractXMLReader;
1914
import org.xml.sax.ContentHandler;
2015
import org.xml.sax.InputSource;
2116
import org.xml.sax.SAXException;
2217
import org.xml.sax.helpers.AttributesImpl;
2318

24-
public class EDIReader extends SAXParser {
19+
public class EDIReader extends AbstractXMLReader {
2520
private Logger logger = LogManager.getLogger(this.getClass());
2621

2722
private String segmentDelimiter;
28-
2923
private String elementDelimiter;
30-
3124
private String subelementDelimiter;
3225

3326
public EDIReader(String segmentDelimiter, String elementDelimiter, String subelementDelimiter) {
@@ -37,7 +30,10 @@ public EDIReader(String segmentDelimiter, String elementDelimiter, String subele
3730
return;
3831
}
3932

33+
@Override
4034
public void parse(InputSource input) throws SAXException, IOException {
35+
ensureHandlerSet();
36+
4137
// Read the data from the InputSource
4238
BufferedReader in = new BufferedReader(input.getCharacterStream());
4339
String nextLine = "";
@@ -175,5 +171,4 @@ public void parse(InputSource input) throws SAXException, IOException {
175171
contentHandler.endElement("", documentHead, "");
176172
contentHandler.endDocument();
177173
}
178-
179174
}

‎server/src/com/mirth/connect/plugins/datatypes/hl7v2/ER7Reader.java‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,6 @@
1-
/*
2-
* Copyright (c) Mirth Corporation. All rights reserved.
3-
*
4-
* http://www.mirthcorp.com
5-
*
6-
* The software in this package is published under the terms of the MPL license a copy of which has
7-
* been included with this distribution in the LICENSE.txt file.
8-
*/
1+
// SPDX-License-Identifier: MPL-2.0
2+
// SPDX-FileCopyrightText: Mirth Corporation
3+
// SPDX-FileCopyrightText: 2025 Tony Germano
94

105
package com.mirth.connect.plugins.datatypes.hl7v2;
116

@@ -16,13 +11,14 @@
1611
import org.apache.commons.lang3.StringUtils;
1712
import org.apache.logging.log4j.LogManager;
1813
import org.apache.logging.log4j.Logger;
19-
import org.apache.xerces.parsers.SAXParser;
14+
import org.openintegrationengine.engine.plugins.datatypes.AbstractXMLReader;
2015
import org.xml.sax.ContentHandler;
2116
import org.xml.sax.InputSource;
2217
import org.xml.sax.SAXException;
2318

24-
public class ER7Reader extends SAXParser {
19+
public class ER7Reader extends AbstractXMLReader {
2520
private Logger logger = LogManager.getLogger(this.getClass());
21+
2622
private boolean handleRepetitions = false;
2723
private boolean handleSubcomponents = false;
2824
private String segmentDelimiter;
@@ -54,7 +50,10 @@ private String getMessageFromSource(InputSource source) throws IOException {
5450
return builder.toString().trim();
5551
}
5652

53+
@Override
5754
public void parse(InputSource source) throws SAXException, IOException {
55+
ensureHandlerSet();
56+
5857
String message = getMessageFromSource(source);
5958
ContentHandler contentHandler = getContentHandler();
6059
contentHandler.startDocument();

0 commit comments

Comments
 (0)