Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

liquibase support setting of liquibase.secureParsing in application.properties #47101

Closed
col-panic opened this issue Apr 1, 2025 · 8 comments · Fixed by #47186
Closed

liquibase support setting of liquibase.secureParsing in application.properties #47101

col-panic opened this issue Apr 1, 2025 · 8 comments · Fixed by #47186
Labels
area/liquibase kind/bug Something isn't working
Milestone

Comments

@col-panic
Copy link

Describe the bug

This is on quarkus 3.21

Liquibase denies loading a local xsd file and also has problems with http:// urls for loading xsd schemas.
According to liquibase/liquibase#2654 the property -Dliquibase.secureParsing=false has to be set to be allowed to load these files.

At the moment I can only add this via

./mvnw test -Dliquibase.secureParsing=false

Please extend quarkus-liquibase, resp. the application.properties to include the setting like quarkus.liquibase.secureParsing=false

Expected behavior

No response

Actual behavior

No response

How to Reproduce?

No response

Output of uname -a or ver

No response

Output of java -version

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

@col-panic col-panic added the kind/bug Something isn't working label Apr 1, 2025
Copy link

quarkus-bot bot commented Apr 1, 2025

/cc @andrejpetras (liquibase), @geoand (liquibase), @gsmet (liquibase)

@geoand
Copy link
Contributor

geoand commented Apr 1, 2025

Makes sense!

Would you like to contribute this?

@col-panic
Copy link
Author

@geoand I'm really very new to quarkus, maybe 24 hours ;) still trying to find my way around! Doing a technology analysis quarkus vs spring boot - not sure if identifying a bug this early is a +1 😁 so please do not nail me on that this early :)

@geoand
Copy link
Contributor

geoand commented Apr 1, 2025

Of course, no pressure!

You likely would have to do something very similar to what we do with the quarkus.liquibase.allow-duplicated-changeset-identifiers property. You can start pulling at that thread by looking here.

It goes without saying that we are here to help :)

@gsmet
Copy link
Member

gsmet commented Apr 4, 2025

not sure if identifying a bug this early is a +1

I wouldn't call us not exposing a configuration that is not recommended a bug. Especially since you can set it from the command line.

That being said, I created #47186 but we need to discuss things a bit and polish it before merging.

@col-panic
Copy link
Author

@gsmet yes, you are right about that. Thanks for your input and work.

@gsmet gsmet closed this as completed in 1f45299 Apr 7, 2025
@quarkus-bot quarkus-bot bot added this to the 3.22 - main milestone Apr 7, 2025
@gsmet
Copy link
Member

gsmet commented Apr 7, 2025

@col-panic we added quarkus.liquibase.secure-parsing (it defaults to true). It's going to be available in the upcoming 3.21.2 planned for Wednesday.

@col-panic
Copy link
Author

@gsmet whow - now thats impressive! Thank you very much!!

@gsmet gsmet modified the milestones: 3.22 - main, 3.21.2 Apr 8, 2025
gsmet added a commit to gsmet/quarkus that referenced this issue Apr 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/liquibase kind/bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants