WSDL Validation: Resolution of embedded schemas, ns aware filter of soap elements…#3071
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughSchema validation now consolidates embedded-schema errors into one failure path, WSDL import resolution handles namespace-only references between embedded schemas, and SOAP body extraction matches SOAP namespaces while preserving non-SOAP ChangesSchema/WSDL validation and SOAP parsing fixes
Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
core/src/test/java/com/predic8/membrane/core/interceptor/schemavalidation/SOAPXMLFilterTest.java (1)
73-76: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueConsider enabling secure processing on TransformerFactory.
Static analysis flagged
TransformerFactory.newInstance().newTransformer()without secure processing (CWE-611). While the input is controlled test data so the actual risk is negligible, enabling secure processing is a simple best practice even in tests to avoid normalizing insecure XML parsing patterns.🔒️ Optional hardening
private static String filterSoapBody(String soap) throws Exception { - Transformer t = TransformerFactory.newInstance().newTransformer(); + TransformerFactory tf = TransformerFactory.newInstance(); + tf.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true); + Transformer t = tf.newTransformer(); StringWriter sw = new StringWriter(); t.transform(MessageUtil.getSOAPBody(new ByteArrayInputStream(soap.getBytes(UTF_8))), new StreamResult(sw)); return sw.toString(); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@core/src/test/java/com/predic8/membrane/core/interceptor/schemavalidation/SOAPXMLFilterTest.java` around lines 73 - 76, The SOAP body filtering helper uses TransformerFactory.newInstance().newTransformer() without secure processing, so update filterSoapBody to configure the TransformerFactory with secure processing before creating the Transformer. Keep the change localized to the filterSoapBody method in SOAPXMLFilterTest, and ensure the TransformerFactory setup explicitly enables the secure XML processing feature rather than using the default factory behavior.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@core/src/test/java/com/predic8/membrane/core/interceptor/schemavalidation/SOAPXMLFilterTest.java`:
- Around line 73-76: The SOAP body filtering helper uses
TransformerFactory.newInstance().newTransformer() without secure processing, so
update filterSoapBody to configure the TransformerFactory with secure processing
before creating the Transformer. Keep the change localized to the filterSoapBody
method in SOAPXMLFilterTest, and ensure the TransformerFactory setup explicitly
enables the secure XML processing feature rather than using the default factory
behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: caf5ea40-743d-45fa-9330-4ec21deb9887
📒 Files selected for processing (10)
core/src/main/java/com/predic8/membrane/core/interceptor/schemavalidation/AbstractXMLSchemaValidator.javacore/src/main/java/com/predic8/membrane/core/interceptor/schemavalidation/SOAPXMLFilter.javacore/src/main/java/com/predic8/membrane/core/interceptor/schemavalidation/SchemaValidatorErrorHandler.javacore/src/main/java/com/predic8/membrane/core/interceptor/schemavalidation/WSDLValidator.javacore/src/main/java/com/predic8/membrane/core/util/SOAPUtil.javacore/src/test/java/com/predic8/membrane/core/interceptor/schemavalidation/MultiSchemaValidationLoggingTest.javacore/src/test/java/com/predic8/membrane/core/interceptor/schemavalidation/SOAPXMLFilterTest.javacore/src/test/java/com/predic8/membrane/core/ws/WSDLIncludeImportTest.javacore/src/test/resources/ws/import/second-schema-match.wsdldistribution/release-notes/7.3.1.md
rrayst
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…, logging
Summary by CodeRabbit
<Body>element by SOAP namespace (preserving non-SOAP elements namedBody).<xsd:import>across embedded schemas.