From 18fd136fa155befe4e43f294c5629c178d5e6414 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Wed, 21 Oct 2026 08:52:49 +0000
Subject: [PATCH] GHSA-jr68-5c58-j463 DSMLv2 gateway changes XML data binding of other applications in the same JVM
---
opendj-dsml-servlet/resources/webapp/web.xml | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/opendj-dsml-servlet/resources/webapp/web.xml b/opendj-dsml-servlet/resources/webapp/web.xml
index 81476b2..18406d9 100644
--- a/opendj-dsml-servlet/resources/webapp/web.xml
+++ b/opendj-dsml-servlet/resources/webapp/web.xml
@@ -88,6 +88,14 @@
independently, so a DNS name whose records change between the two lookups
(DNS rebinding) can still reach an internal address; only enable
dereferencing for trusted clients.
+ Enabling this also sets the JVM-global "mapAnyUriToUri" system property,
+ which the JAXB reference implementation reads once, when it initialises:
+ every other application in the same JVM that initialises JAXB afterwards
+ then binds xsd:anyURI to java.net.URI instead of to java.lang.String
+ (GHSA-jr68-5c58-j463). In this gateway that binding also makes an anyURI
+ value which is not a valid java.net.URI - one holding a space, a pipe or a
+ brace - be rejected with an unresolvableURI error instead of being stored
+ verbatim.
<context-param>
<description>Enable server-side dereferencing of anyURI values (default false)</description>
<param-name>ldap.dsml.dereference.anyuri</param-name>
--
Gitblit v1.10.0