HV-2103 Include Jakarta Validation 3.1 XSDs / HV-2102 Disable external schema loading

cdi/src/test/resources/org/hibernate/validator/test/cdi/internal/injection/validation.xml

@@ -4,8 +4,8 @@
 	Copyright Red Hat Inc. and Hibernate Authors
 -->
 <validation-config xmlns="https://jakarta.ee/xml/ns/validation/configuration"
-				xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.0.xsd"
+				xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.1.xsd"
 				xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-				version="3.0">
+				version="3.1">
 	<default-provider>org.hibernate.validator.test.cdi.internal.injection.MyValidationProvider</default-provider>
 </validation-config>

cdi/src/test/resources/org/hibernate/validator/test/cdi/internal/methodvalidation/getter/validation-validate-executable-getter.xml

@@ -6,8 +6,8 @@
 <validation-config
 		xmlns="https://jakarta.ee/xml/ns/validation/configuration"
 		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-		xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.0.xsd"
-		version="3.0">
+		xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.1.xsd"
+		version="3.1">
 	<executable-validation>
 		<default-validated-executable-types>
 			<executable-type>GETTER_METHODS</executable-type>

cdi/src/test/resources/org/hibernate/validator/test/cdi/internal/methodvalidation/validation-disable-executable-validation.xml

@@ -6,7 +6,7 @@
 <validation-config
 		xmlns="https://jakarta.ee/xml/ns/validation/configuration"
 		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-		xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.0.xsd"
-		version="3.0">
+		xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.1.xsd"
+		version="3.1">
 	<executable-validation enabled="false"/>
 </validation-config>

documentation/src/main/asciidoc/ch12.asciidoc

@@ -134,8 +134,8 @@ _hibernate.validator.allow_parallel_method_parameter_constraint_ in _validation.
 <validation-config
         xmlns="https://jakarta.ee/xml/ns/validation/configuration"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-        xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.0.xsd"
-        version="3.0">
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.1.xsd"
+        version="3.1">
     <default-provider>org.hibernate.validator.HibernateValidator</default-provider>
 
     <property name="hibernate.validator.allow_parameter_constraint_override">true</property>

documentation/src/test/java/org/hibernate/validator/referenceguide/chapter09/validation-DisableTraversableResolverResultCache.xml

@@ -5,8 +5,8 @@
 -->
 <validation-config xmlns="https://jakarta.ee/xml/ns/validation/configuration"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.0.xsd"
-	version="3.0">
+	xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.1.xsd"
+	version="3.1">
 	<default-provider>org.hibernate.validator.HibernateValidator</default-provider>
 
 	<property name="hibernate.validator.enable_traversable_resolver_result_cache">false</property>

documentation/src/test/java/org/hibernate/validator/referenceguide/chapter09/validation-ShowValidatedValueInLogs.xml

@@ -5,8 +5,8 @@
 -->
 <validation-config xmlns="https://jakarta.ee/xml/ns/validation/configuration"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.0.xsd"
-	version="3.0">
+	xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration https://jakarta.ee/xml/ns/validation/validation-configuration-3.1.xsd"
+	version="3.1">
 	<default-provider>org.hibernate.validator.HibernateValidator</default-provider>
 
 	<property name="hibernate.validator.show_validated_value_in_trace_logs">true</property>

documentation/src/test/resources/org/hibernate/validator/referenceguide/chapter08/rental-car-mapping.xml

@@ -7,8 +7,8 @@
 		xmlns="https://jakarta.ee/xml/ns/validation/mapping"
 		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 		xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/mapping
-			https://jakarta.ee/xml/ns/validation/validation-mapping-3.0.xsd"
-		version="3.0">
+			https://jakarta.ee/xml/ns/validation/validation-mapping-3.1.xsd"
+		version="3.1">
 
 	<default-package>org.hibernate.validator.referenceguide.chapter05</default-package>
 	<bean class="Car" ignore-annotations="true">

documentation/src/test/resources/org/hibernate/validator/referenceguide/chapter08/rental-station-mapping.xml

@@ -7,8 +7,8 @@
 		xmlns="https://jakarta.ee/xml/ns/validation/mapping"
 		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 		xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/mapping
-			https://jakarta.ee/xml/ns/validation/validation-mapping-3.0.xsd"
-		version="3.0">
+			https://jakarta.ee/xml/ns/validation/validation-mapping-3.1.xsd"
+		version="3.1">
 
 	<default-package>org.hibernate.validator.referenceguide.chapter08</default-package>
 

documentation/src/test/resources/org/hibernate/validator/referenceguide/chapter08/validation.xml

@@ -7,8 +7,8 @@
 		xmlns="https://jakarta.ee/xml/ns/validation/configuration"
 		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 		xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration
-			https://jakarta.ee/xml/ns/validation/validation-configuration-3.0.xsd"
-		version="3.0">
+			https://jakarta.ee/xml/ns/validation/validation-configuration-3.1.xsd"
+		version="3.1">
 
 	<default-provider>com.acme.ValidationProvider</default-provider>
 

documentation/src/test/resources/org/hibernate/validator/referenceguide/chapter09/script-evaluator-factory-validation.xml

@@ -7,8 +7,8 @@
 		xmlns="https://jakarta.ee/xml/ns/validation/configuration"
 		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 		xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration
-			https://jakarta.ee/xml/ns/validation/validation-configuration-3.0.xsd"
-		version="3.0">
+			https://jakarta.ee/xml/ns/validation/validation-configuration-3.1.xsd"
+		version="3.1">
 
 	<property name="hibernate.validator.script_evaluator_factory">
 		org.hibernate.validator.referenceguide.chapter09.CustomScriptEvaluatorFactory

documentation/src/test/resources/org/hibernate/validator/referenceguide/chapter12/getter-property-selection-strategy-validation.xml

@@ -7,8 +7,8 @@
 		xmlns="https://jakarta.ee/xml/ns/validation/configuration"
 		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 		xsi:schemaLocation="https://jakarta.ee/xml/ns/validation/configuration
-			https://jakarta.ee/xml/ns/validation/validation-configuration-3.0.xsd"
-		version="3.0">
+			https://jakarta.ee/xml/ns/validation/validation-configuration-3.1.xsd"
+		version="3.1">
 
 	<property name="hibernate.validator.getter_property_selection_strategy">
 		org.hibernate.validator.referenceguide.chapter12.getterselectionstrategy.NoPrefixGetterPropertySelectionStrategy

engine/src/main/java/org/hibernate/validator/internal/util/logging/Log.java

@@ -942,4 +942,8 @@ ConstraintDefinitionException getConstraintValidatorDefinitionConstraintMismatch
 	@Message(id = 268, value = "The default group sequence provider %s does not implement neither `getValidationGroups(Class<?> klass, T object)` nor `getValidationGroups(T object)` methods."
 			+ " One of them has to be implemented for the default group sequence provider to be correctly defined.")
 	GroupDefinitionException getDefaultGroupSequenceProviderTypeDoesNotImplementAnyMethodsException(@FormatWith(ClassObjectFormatter.class) Class<?> klass);
+
+	@LogMessage(level = DEBUG)
+	@Message(id = 269, value = "Unable to enable secure XML feature processing when loading %1$s: %2$s")
+	void unableToEnableSecureFeatureProcessingSchemaXml(String fileName, String message);
 }

engine/src/main/java/org/hibernate/validator/internal/xml/XmlParserHelper.java

@@ -29,6 +29,8 @@
 import org.hibernate.validator.internal.util.logging.Log;
 import org.hibernate.validator.internal.util.logging.LoggerFactory;
 
+import org.xml.sax.SAXException;
+
 /**
  * Provides common functionality used within the different XML descriptor
  * parsers.
@@ -140,6 +142,14 @@ private Schema loadSchema(String schemaResource) {
 
 		URL schemaUrl = GetResource.action( loader, schemaResource );
 		SchemaFactory sf = SchemaFactory.newInstance( javax.xml.XMLConstants.W3C_XML_SCHEMA_NS_URI );
+
+		try {
+			sf.setFeature( javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true );
+		}
+		catch (SAXException e) {
+			LOG.unableToEnableSecureFeatureProcessingSchemaXml( schemaResource, e.getMessage() );
+		}
+
 		Schema schema = null;
 		try {
 			schema = NewSchema.action( sf, schemaUrl );

engine/src/main/java/org/hibernate/validator/internal/xml/config/ValidationXmlParser.java

@@ -7,7 +7,6 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.lang.invoke.MethodHandles;
-import java.util.Collections;
 import java.util.Map;
 
 import javax.xml.stream.XMLEventReader;
@@ -18,7 +17,6 @@
 
 import jakarta.validation.BootstrapConfiguration;
 
-import org.hibernate.validator.internal.util.CollectionHelper;
 import org.hibernate.validator.internal.util.actions.GetClassLoader;
 import org.hibernate.validator.internal.util.actions.SetContextClassLoader;
 import org.hibernate.validator.internal.util.logging.Log;
@@ -39,21 +37,16 @@ public class ValidationXmlParser {
 	private static final Log LOG = LoggerFactory.make( MethodHandles.lookup() );
 
 	private static final String VALIDATION_XML_FILE = "META-INF/validation.xml";
-	private static final Map<String, String> SCHEMAS_BY_VERSION = Collections.unmodifiableMap( getSchemasByVersion() );
+	private static final Map<String, String> SCHEMAS_BY_VERSION = Map.of(
+			"1.0", "META-INF/validation-configuration-1.0.xsd",
+			"1.1", "META-INF/validation-configuration-1.1.xsd",
+			"2.0", "META-INF/validation-configuration-2.0.xsd",
+			"3.0", "META-INF/validation-configuration-3.0.xsd",
+			"3.1", "META-INF/validation-configuration-3.1.xsd"
+	);
 
 	private final ClassLoader externalClassLoader;
 
-	private static Map<String, String> getSchemasByVersion() {
-		Map<String, String> schemasByVersion = CollectionHelper.newHashMap( 4 );
-
-		schemasByVersion.put( "1.0", "META-INF/validation-configuration-1.0.xsd" );
-		schemasByVersion.put( "1.1", "META-INF/validation-configuration-1.1.xsd" );
-		schemasByVersion.put( "2.0", "META-INF/validation-configuration-2.0.xsd" );
-		schemasByVersion.put( "3.0", "META-INF/validation-configuration-3.0.xsd" );
-
-		return schemasByVersion;
-	}
-
 	public ValidationXmlParser(ClassLoader externalClassLoader) {
 		this.externalClassLoader = externalClassLoader;
 	}

engine/src/main/java/org/hibernate/validator/internal/xml/mapping/MappingXmlParser.java

@@ -11,7 +11,6 @@
 import java.io.InputStream;
 import java.lang.invoke.MethodHandles;
 import java.util.Collections;
-import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -58,18 +57,13 @@ public class MappingXmlParser {
 
 	private final ClassLoadingHelper classLoadingHelper;
 
-	private static final Map<String, String> SCHEMAS_BY_VERSION = Collections.unmodifiableMap( getSchemasByVersion() );
-
-	private static Map<String, String> getSchemasByVersion() {
-		Map<String, String> schemasByVersion = new HashMap<>();
-
-		schemasByVersion.put( "1.0", "META-INF/validation-mapping-1.0.xsd" );
-		schemasByVersion.put( "1.1", "META-INF/validation-mapping-1.1.xsd" );
-		schemasByVersion.put( "2.0", "META-INF/validation-mapping-2.0.xsd" );
-		schemasByVersion.put( "3.0", "META-INF/validation-mapping-3.0.xsd" );
-
-		return schemasByVersion;
-	}
+	private static final Map<String, String> SCHEMAS_BY_VERSION = Map.of(
+			"1.0", "META-INF/validation-mapping-1.0.xsd",
+			"1.1", "META-INF/validation-mapping-1.1.xsd",
+			"2.0", "META-INF/validation-mapping-2.0.xsd",
+			"3.0", "META-INF/validation-mapping-3.0.xsd",
+			"3.1", "META-INF/validation-mapping-3.1.xsd"
+	);
 
 	public MappingXmlParser(ConstraintCreationContext constraintCreationContext, JavaBeanHelper javaBeanHelper, ClassLoader externalClassLoader) {
 		this.constraintCreationContext = constraintCreationContext;

engine/src/main/xsd/validation-configuration-3.1.xsd

@@ -0,0 +1,96 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Jakarta Validation API
+  ~
+  ~ License: Apache License, Version 2.0
+  ~ See the license.txt file in the root directory or <http://www.apache.org/licenses/LICENSE-2.0>.
+  -->
+<xs:schema attributeFormDefault="unqualified"
+           elementFormDefault="qualified"
+           targetNamespace="https://jakarta.ee/xml/ns/validation/configuration"
+           xmlns:xs="http://www.w3.org/2001/XMLSchema"
+           xmlns:config="https://jakarta.ee/xml/ns/validation/configuration"
+           version="3.1">
+
+    <xs:annotation>
+        <xs:documentation><![CDATA[
+            This is the XML Schema for the Jakarta Validation configuration file.
+            The configuration file must be named "META-INF/validation.xml".
+
+            Jakarta Validation configuration files must indicate the Jakarta Validation
+            XML schema by using the validation namespace:
+
+            https://jakarta.ee/xml/ns/validation/configuration
+
+            and indicate the version of the schema by using the version attribute
+            as shown below:
+
+            <validation-config
+                xmlns="https://jakarta.ee/xml/ns/validation/configuration"
+                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                xsi:schemaLocation="
+                    https://jakarta.ee/xml/ns/validation/configuration
+                    https://jakarta.ee/xml/ns/validation/validation-configuration-3.1.xsd"
+                version="3.1">
+                [...]
+            </validation-config>
+        ]]>
+        </xs:documentation>
+    </xs:annotation>
+
+    <xs:element name="validation-config" type="config:validation-configType"/>
+    <xs:complexType name="validation-configType">
+        <xs:sequence>
+            <xs:element type="xs:string" name="default-provider" minOccurs="0"/>
+            <xs:element type="xs:string" name="message-interpolator" minOccurs="0"/>
+            <xs:element type="xs:string" name="traversable-resolver" minOccurs="0"/>
+            <xs:element type="xs:string" name="constraint-validator-factory" minOccurs="0"/>
+            <xs:element type="xs:string" name="parameter-name-provider" minOccurs="0"/>
+            <xs:element type="xs:string" name="clock-provider" minOccurs="0"/>
+            <xs:element type="xs:string" name="value-extractor" maxOccurs="unbounded"
+                    minOccurs="0"/>
+            <xs:element type="config:executable-validationType" name="executable-validation"
+                    minOccurs="0"/>
+            <xs:element type="xs:string" name="constraint-mapping" maxOccurs="unbounded"
+                    minOccurs="0"/>
+            <xs:element type="config:propertyType" name="property" maxOccurs="unbounded"
+                    minOccurs="0"/>
+        </xs:sequence>
+        <xs:attribute name="version" type="config:versionType" fixed="3.1" use="required"/>
+    </xs:complexType>
+
+    <xs:complexType name="executable-validationType">
+        <xs:sequence>
+            <xs:element type="config:default-validated-executable-typesType"
+                    name="default-validated-executable-types" minOccurs="0"/>
+        </xs:sequence>
+        <xs:attribute name="enabled" use="optional" type="xs:boolean" default="true"/>
+    </xs:complexType>
+    <xs:complexType name="default-validated-executable-typesType">
+        <xs:sequence>
+            <xs:element name="executable-type" maxOccurs="unbounded" minOccurs="1">
+                <xs:simpleType>
+                    <xs:restriction base="xs:string">
+                        <xs:enumeration value="NONE"/>
+                        <xs:enumeration value="CONSTRUCTORS"/>
+                        <xs:enumeration value="NON_GETTER_METHODS"/>
+                        <xs:enumeration value="GETTER_METHODS"/>
+                        <xs:enumeration value="ALL"/>
+                    </xs:restriction>
+                </xs:simpleType>
+            </xs:element>
+        </xs:sequence>
+    </xs:complexType>
+    <xs:complexType name="propertyType">
+        <xs:simpleContent>
+            <xs:extension base="xs:string">
+                <xs:attribute name="name" use="required" type="xs:string"/>
+            </xs:extension>
+        </xs:simpleContent>
+    </xs:complexType>
+    <xs:simpleType name="versionType">
+        <xs:restriction base="xs:token">
+            <xs:pattern value="[0-9]+(\.[0-9]+)*" />
+        </xs:restriction>
+    </xs:simpleType>
+</xs:schema>