From 56d43478c62e8f45a964c393bd0b7f78211f5cc8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martynas=20Jusevi=C4=8Dius?= Date: Sun, 26 Jul 2026 10:42:43 +0300 Subject: [PATCH 1/5] [maven-release-plugin] prepare for next development iteration --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 50635e15f..5d3191ad3 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ com.atomgraph linkeddatahub - 5.6.1 + 5.6.2-SNAPSHOT ${packaging.type} AtomGraph LinkedDataHub @@ -46,7 +46,7 @@ https://github.com/AtomGraph/LinkedDataHub scm:git:git://github.com/AtomGraph/LinkedDataHub.git scm:git:git@github.com:AtomGraph/LinkedDataHub.git - linkeddatahub-5.6.1 + linkeddatahub-5.5.4 From 16070da09c9cf04a608daea191a53d6eb7c7089c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martynas=20Jusevi=C4=8Dius?= Date: Sun, 26 Jul 2026 13:34:16 +0300 Subject: [PATCH 2/5] Add missing CHANGELOG entry for 5.6.1 Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index eb1c7ded1..3a125b3c5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,18 +1,28 @@ -## [Unreleased] +## [5.6.1] - 2026-07-26 ### Security -- SSRF: `URLValidator` now blocks wildcard/any-local (0.0.0.0, ::) addresses in addition to link-local and private ranges, and checks every address the host resolves to (narrowing the DNS-rebinding window). Loopback stays reachable for same-origin document/WebID dereferencing; the backend triplestore is site-local (already blocked). `ALLOW_INTERNAL_URLS` remains the development escape hatch (LNK-003/LNK-009) -- XXE: added `SecureXML` hardened parser factories — `XSLTMasterUpdater` parses with DTDs and external entities disabled, and the external responses parsed by `ldh:send-request` use secure processing (entity-expansion capped) with external entities disabled (LNK-005 residual) +- SSRF: `URLValidator` blocks wildcard/any-local (`0.0.0.0`, `::`) addresses and checks every resolved address; loopback stays reachable, `ALLOW_INTERNAL_URLS` remains the escape hatch (LNK-003/LNK-009) +- XXE: `SecureXML` hardened parser factories disable DTDs/external entities in `XSLTMasterUpdater` and `ldh:send-request` responses (LNK-005 residual) - Upgraded `java-jwt` 3.19.4 → 4.5.2 on the OAuth2/OIDC verification path -- Documented the pinned-truststore invariant behind the disabled hostname verification on internal HTTP clients +- Documented the pinned-truststore invariant behind disabled hostname verification on internal HTTP clients ### Added -- Unit tests for `AuthorizationFilter`: the HTTP-method → ACL access-mode contract (`GET`/`HEAD`→Read, `POST`→Append, `PUT`/`DELETE`/`PATCH`→Write), mode lookup, and the owner Read/Write/Append grant -- Loopback/wildcard `URLValidator` tests; JWKS-based `JWTVerifier` tests (valid, wrong issuer, wrong audience, expired, missing `kid`, bad signature) -- `AGENTS.md`: an agent-facing guide to driving a running instance's HTTP API — data model, WebID auth, read/write discipline (writes via `POST`/`PUT`/`PATCH` on document URLs; read-only SPARQL), content model, dataspaces, tooling -- Dependabot config (`.github/dependabot.yml`) for Maven, the Docker base image, and GitHub Actions updates; routine Maven minor/patch bumps grouped into one PR +- Unit tests for `AuthorizationFilter`'s HTTP-method → ACL access-mode contract, mode lookup, and owner grant +- Loopback/wildcard `URLValidator` tests; JWKS-based `JWTVerifier` tests +- `AGENTS.md`: agent-facing guide to driving a running instance's HTTP API +- Dependabot config (`.github/dependabot.yml`) for Maven, the Docker base image, and GitHub Actions ### Changed -- Cache TTLs configurable: the WebID model cache and the JWKS cache now read their expiration (seconds) from `WEBID_CACHE_EXPIRATION` / `JWKS_CACHE_EXPIRATION` (default 86400 = 1 day), via `CATALINA_OPTS` system properties like the `CLIENT_*` timeouts. Lowering `WEBID_CACHE_EXPIRATION` bounds how long a revoked WebID stays authenticated +- Cache TTLs configurable via `WEBID_CACHE_EXPIRATION` / `JWKS_CACHE_EXPIRATION` (default 86400s), bounding how long a revoked WebID stays authenticated +- CSR label rendering consolidated on Web-Client per-vocab templates; retired `$ldt:lang` for `$ac:langs` from `navigator.languages`; added client-side `ac:uuid()` (#323) +- Web-Client dependency bumped to 5.0.3 + +### Fixed +- View queries with a `FROM`/`FROM NAMED` clause returned `400`; `ldh:wrap-describe` now hoists the clause to the outer `DESCRIBE` +- Duplicate bilingual widget headings when the browser language matched neither value (#323) +- Language badge leaking into view headings (e.g. `enCurrent members`) +- `acl:mode()` went stale on fetch-less tab-pane switches; flags now re-synced from the activated pane +- Modal live-search debounce logged an unsupported-scheme fetch from `document="ixsl:page()"` +- Left-sidebar flyout clipped on short viewports; now scrolls ## [5.6.0] - 2026-07-08 ### Added From 20c8277fc62119451172efda9c1f0ce299db7373 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martynas=20Jusevi=C4=8Dius?= Date: Sun, 26 Jul 2026 19:24:50 +0300 Subject: [PATCH 3/5] Move entity-inlining and SEF compilation to pre-integration-test phase Prevents maven-war-plugin:war from overwriting entity-resolved overlay stylesheets before the Dockerfile copies target/ROOT. Co-Authored-By: Claude Sonnet 4.6 --- pom.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pom.xml b/pom.xml index 5d3191ad3..50c92c80f 100644 --- a/pom.xml +++ b/pom.xml @@ -339,7 +339,7 @@ inline-xml-entities - package + pre-integration-test iterator @@ -377,14 +377,14 @@ install-node-and-npm - package + pre-integration-test generate-sef npx - package + pre-integration-test xslt3-he -t -xsl:${project.build.directory}/${build.warName}${saxon-js.stylesheet} -export:${project.build.directory}/${build.warName}${saxon-js.stylesheet}.sef.json -nogo -ns:##html5 -relocate:on From 11d589de797eeadc0d015bb43e4827e576776355 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martynas=20Jusevi=C4=8Dius?= Date: Sat, 1 Aug 2026 11:42:47 +0200 Subject: [PATCH 4/5] Resolve static asset URIs against client-side $lapp:origin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Declare $lapp:origin in the client.xsl param block with a computed default — lapp:origin(ldh:request-uri()), the browser origin — emulating the server-side writer-set param (XSLTWriterBase), and switch all 140 static-asset lookups (translations.rdf, http-statusCodes.rdf, countries.rdf, signup icon) from the 0-arg lapp:origin() back to $lapp:origin. The 0-arg lapp:origin() reads the active pane's data-base, which for a proxied LDH pane is the remote origin (stamped from the Link rel=lapp:application header). Asset document() calls therefore issued cross-origin sync XHRs that the browser blocked on CORS — "Get failure https://…/translations.rdf" when browsing remote dataspaces in ContentMode. Introduced by the #303 sweep ($ac:contextUri → lapp:origin()) and extended by bd0417c53. UI labels are client-local: chrome strings are constants of the client, versioned with the SEF and resolved against the shell origin. The pane-scoped 0-arg lapp:origin() remains in place for the admin-subdomain identity checks and other per-dataspace logic. SSR output is byte-identical ($lapp:origin was already the resolved base server-side), so the Saxon and SaxonJS document-pool preloads keep matching and local rendering still performs zero asset fetches. Co-Authored-By: Claude Fable 5 --- .../bootstrap/2.3.2/client/admin/signup.xsl | 4 +- .../xsl/bootstrap/2.3.2/client/block.xsl | 2 +- .../bootstrap/2.3.2/client/block/chart.xsl | 4 +- .../bootstrap/2.3.2/client/block/query.xsl | 8 +-- .../xsl/bootstrap/2.3.2/client/block/view.xsl | 12 ++-- .../bootstrap/2.3.2/client/constructor.xsl | 12 ++-- .../xsl/bootstrap/2.3.2/client/form.xsl | 4 +- .../xsl/bootstrap/2.3.2/client/modal.xsl | 72 +++++++++---------- .../xsl/bootstrap/2.3.2/client/navigation.xsl | 36 +++++----- .../xsl/bootstrap/2.3.2/document.xsl | 54 +++++++------- .../xsl/bootstrap/2.3.2/imports/acl.xsl | 2 +- .../xsl/bootstrap/2.3.2/imports/cert.xsl | 2 +- .../xsl/bootstrap/2.3.2/imports/default.xsl | 4 +- .../xsl/bootstrap/2.3.2/imports/lapp.xsl | 6 +- .../xsl/bootstrap/2.3.2/imports/nfo.xsl | 2 +- .../xsl/bootstrap/2.3.2/imports/rdf.xsl | 4 +- .../xsl/bootstrap/2.3.2/imports/sioc.xsl | 2 +- .../xsl/bootstrap/2.3.2/imports/sp.xsl | 8 +-- .../xsl/bootstrap/2.3.2/resource.xsl | 38 +++++----- .../atomgraph/linkeddatahub/xsl/client.xsl | 5 +- 20 files changed, 141 insertions(+), 140 deletions(-) diff --git a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/admin/signup.xsl b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/admin/signup.xsl index 00e493f4d..e0d56de28 100644 --- a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/admin/signup.xsl +++ b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/admin/signup.xsl @@ -172,7 +172,7 @@ exclude-result-prefixes="#all"> - + @@ -327,7 +327,7 @@ exclude-result-prefixes="#all"> - + diff --git a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block.xsl b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block.xsl index 96fa08abf..d94e90e29 100644 --- a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block.xsl +++ b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block.xsl @@ -362,7 +362,7 @@ exclude-result-prefixes="#all" - + diff --git a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/chart.xsl b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/chart.xsl index 726a0b9fa..0f2976dd4 100644 --- a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/chart.xsl +++ b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/chart.xsl @@ -272,11 +272,11 @@ exclude-result-prefixes="#all"
diff --git a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/query.xsl b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/query.xsl index 13682e71a..a1944e0e3 100644 --- a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/query.xsl +++ b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/query.xsl @@ -225,22 +225,22 @@ exclude-result-prefixes="#all"
diff --git a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/view.xsl b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/view.xsl index 269fd4b34..c309ecd42 100644 --- a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/view.xsl +++ b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/block/view.xsl @@ -219,7 +219,7 @@ exclude-result-prefixes="#all" - + @@ -817,7 +817,7 @@ exclude-result-prefixes="#all" @@ -841,14 +841,14 @@ exclude-result-prefixes="#all" @@ -901,7 +901,7 @@ exclude-result-prefixes="#all" - + @@ -1190,7 +1190,7 @@ exclude-result-prefixes="#all"

- +