pgjdbc/pgjdbc GitHub issues and pull requests (mirror)  

help / color / mirror / Atom feed

[pgjdbc/pgjdbc] issue #3747: Can not set custom PGXmlFactoryFactory
4+ messages / 3 participants
[nested] [flat]

* [pgjdbc/pgjdbc] issue #3747: Can not set custom PGXmlFactoryFactory
@ 2025-07-29 13:12  "eitch (@eitch)" <[email protected]>
  0 siblings, 0 replies; 4+ messages in thread

From: eitch (@eitch) @ 2025-07-29 13:12 UTC (permalink / raw)
  To: pgjdbc/pgjdbc <[email protected]>

When i try to set a custom PGXmlFactoryFactory with the following implementation:

```java
public class CachingPGXmlFactoryFactory implements PGXmlFactoryFactory {

	@Override
	public DocumentBuilder newDocumentBuilder() throws ParserConfigurationException {
		return this.documentBuilder;
	}

	@Override
	public TransformerFactory newTransformerFactory() {
		return this.transformerFactory;
	}

	@Override
	public SAXTransformerFactory newSAXTransformerFactory() {
		return this.saxTransformerFactory;
	}

	@Override
	public XMLInputFactory newXMLInputFactory() {
		return this.xmlInputFactory;
	}

	@Override
	public XMLOutputFactory newXMLOutputFactory() {
		return this.xmlOutputFactory;
	}

	@Override
	public XMLReader createXMLReader() throws SAXException {
		return this.xmlReader;
	}
}
```

Then i get the following error:
```
Connection property xmlFactoryFactory must implement PGXmlFactoryFactory: li.strolch.persistence.postgresql.CachingPGXmlFactoryFactory
```

I thought i messed up, so i simply used the default factory and i get the same exception:
```
Connection property xmlFactoryFactory must implement PGXmlFactoryFactory: org.postgresql.xml.DefaultPGXmlFactoryFactory
```

When i look at the code, i see this:
```java
if (!clazz.isAssignableFrom(PGXmlFactoryFactory.class)) {
    throw new PSQLException(
        GT.tr("Connection property xmlFactoryFactory must implement PGXmlFactoryFactory: {0}", xmlFactoryFactoryClass),
```

In my opinion, the two should be switched as such:
```java
if (!PGXmlFactoryFactory.class.isAssignableFrom(clazz)) {
    throw new PSQLException(
        GT.tr("Connection property xmlFactoryFactory must implement PGXmlFactoryFactory: {0}", xmlFactoryFactoryClass),
```


^ permalink  raw  reply  [nested|flat] 4+ messages in thread

* Re: [pgjdbc/pgjdbc] issue #3747: Can not set custom PGXmlFactoryFactory
@ 2025-07-29 13:17  "davecramer (@davecramer)" <[email protected]>
  2 siblings, 0 replies; 4+ messages in thread

From: davecramer (@davecramer) @ 2025-07-29 13:17 UTC (permalink / raw)
  To: pgjdbc/pgjdbc <[email protected]>

Interesting, can you create a PR with a test ?

^ permalink  raw  reply  [nested|flat] 4+ messages in thread

* Re: [pgjdbc/pgjdbc] issue #3747: Can not set custom PGXmlFactoryFactory
@ 2025-07-29 13:29  "sehrope (@sehrope)" <[email protected]>
  2 siblings, 0 replies; 4+ messages in thread

From: sehrope (@sehrope) @ 2025-07-29 13:29 UTC (permalink / raw)
  To: pgjdbc/pgjdbc <[email protected]>

You're right. I don't think that code ever worked and has been broken since the CVE fix that added it: 14b62aca4764d496813f55a43d050b017e01eb65

You might be the first person to ever actually use it too. Prior to that the XML factory could not be overridden. The override was added as an escape hatch to allow for users that need something separate from the old insecure behavior (via the legacy  `LEGACY INSECURE` option) or the new default secure behavior. But the default and legacy processing branches do not perform any of those checks as it directly instantiates them.

If you open a PR for this (I think it's just reversing that if-statement) I'll take a look later today.

^ permalink  raw  reply  [nested|flat] 4+ messages in thread

* Re: [pgjdbc/pgjdbc] issue #3747: Can not set custom PGXmlFactoryFactory
@ 2025-08-03 19:02  "sehrope (@sehrope)" <[email protected]>
  2 siblings, 0 replies; 4+ messages in thread

From: sehrope (@sehrope) @ 2025-08-03 19:02 UTC (permalink / raw)
  To: pgjdbc/pgjdbc <[email protected]>

Fixed in #3748 

^ permalink  raw  reply  [nested|flat] 4+ messages in thread

end of thread, other threads:[~2025-08-03 19:02 UTC | newest]

Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-07-29 13:12 [pgjdbc/pgjdbc] issue #3747: Can not set custom PGXmlFactoryFactory "eitch (@eitch)" <[email protected]>
2025-07-29 13:17 ` "davecramer (@davecramer)" <[email protected]>
2025-07-29 13:29 ` "sehrope (@sehrope)" <[email protected]>
2025-08-03 19:02 ` "sehrope (@sehrope)" <[email protected]>

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox