[GSOC23] - C - Implement a StAX parser for OVAL files by HoussemNasri · Pull Request #7510 · uyuni-project/uyuni

HoussemNasri · 2023-09-07T21:36:50Z

What does this PR change?

Introduce a StAX parser (instead of the current JAXB parser) for OVAL files to increase memory efficiency when parsing large OVAL files.

Useful Links

The RFC

GUI diff

No difference.

Before:

After:

DONE

Documentation

No documentation needed: add explanation. This can't be used if there is a GUI diff
No documentation needed: only internal and user invisible changes
Documentation issue was created: Link for SUSE Manager contributors, Link for community contributors.
API documentation added: please review the Wiki page Writing Documentation for the API if you have any changes to API documentation.
(OPTIONAL) Documentation PR
DONE

Test coverage

No tests: add explanation
No tests: already covered
Unit tests were added
Cucumber tests were added
DONE

Links

Fixes #
Tracks # add downstream PR, if any

DONE

Changelogs

Make sure the changelogs entries you are adding are compliant with https://github.com/uyuni-project/uyuni/wiki/Contributing#changelogs and https://github.com/uyuni-project/uyuni/wiki/Contributing#uyuni-projectuyuni-repository

If you don't need a changelog check, please mark this checkbox:

No changelog needed

If you uncheck the checkbox after the PR is created, you will need to re-run changelog_test (see below)

Re-run a test

If you need to re-run a test, please mark the related checkbox, it will be unchecked automatically once it has re-run:

Re-run test "changelog_test"
Re-run test "backend_unittests_pgsql"
Re-run test "java_pgsql_tests"
Re-run test "schema_migration_test_pgsql"
Re-run test "susemanager_unittests"
Re-run test "javascript_lint"
Re-run test "spacecmd_unittests"

github-actions · 2023-09-07T21:37:23Z

Suggested tests to cover this Pull Request

srv_docker_cve_audit
min_cve_audit

java/code/src/com/suse/oval/OvalParser.java

java/code/src/com/suse/oval/parser/OvalParser.java

github-actions · 2023-10-26T20:09:44Z

👋 Hello! Thanks for contributing to our project.
Acceptance tests will take some time (aprox. 1h), please be patient ☕

You can see the progress at the end of this page and at https://github.com/uyuni-project/uyuni/pull/7510/checks
Once tests finish, if they fail, you can check 👀 the cucumber report. See the link at the output of the action.
You can also check the artifacts section, which contains the logs at https://github.com/uyuni-project/uyuni/pull/7510/checks.

If you are unsure the failing tests are related to your code, you can check the "reference jobs". These are jobs that run on a scheduled time with code from master. If they fail for the same reason as your build, it means the tests or the infrastructure are broken. If they do not fail, but yours do, it means it is related to your code.

Reference tests:

KNOWN ISSUES

Sometimes the build can fail when pulling new jar files from download.opensuse.org . This is a known limitation. Given this happens rarely, when it does, all you need to do is rerun the test. Sorry for the inconvenience.

For more tips on troubleshooting, see the troubleshooting guide.

Happy hacking!
⚠️ You should not merge if acceptance tests fail to pass. ⚠️

java/code/src/com/suse/oval/parser/OvalParser.java

github-actions · 2023-12-26T01:42:58Z

This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 10 days.

github-actions · 2024-01-05T01:48:08Z

This PR was closed because it has been stalled for 10 days with no activity.

mcalmer · 2024-01-05T07:16:13Z

@HoussemNasri @parlt91 i think this is still needed, right?

HoussemNasri · 2024-01-05T18:03:53Z

@HoussemNasri @parlt91 i think this is still needed, right?

Yes, the A and B pull requests need to be reviewed first before we can move to this one in case there was some changes that would affect this one (all PRs are kind of stacked on each other). Right now, pr A is under review.

mcalmer · 2024-01-05T19:36:02Z

Than we better reopen this request

…Product foreign key

Signed-off-by: Pascal Arlt <parlt@suse.com>

github-actions · 2025-07-20T03:00:36Z

This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 10 days.

admd · 2025-07-29T08:20:35Z

@rjmateus can you please take another look and see if you spot anything.

@parlt91 once reviewed by Ricardo, we should test it a bit more and if all goes well, we should proceed with merging this PR.

Thank you.

rjmateus · 2025-08-11T11:07:29Z

...hema-5.1.6-to-susemanager-schema-5.1.7/100-map-oval-vulnerability-metadata-by-os-product.sql

@@ -0,0 +1,114 @@
+/*


Schema folder needs to be updated

rjmateus · 2025-08-11T11:27:34Z

java/code/src/com/suse/oval/parser/OvalParser.java

+ * The Oval Parser is responsible for parsing OVAL(Open Vulnerability and Assessment Language) documents
+ */
+public class OvalParser {
+    public static final int DEFINITIONS_BULK_SIZE = 500;


We should ready this from a configuration, where the default can be 500.

rjmateus · 2025-08-11T13:31:24Z

java/code/src/com/suse/oval/parser/OvalParser.java

+     * @param ovalFileURL the OVAL file to parse
+     * @return the parsed OVAL encapsulated in an {@link OvalRootType} object.
+     * */
+    public OvalRootType parse(URL ovalFileURL) throws OvalParserException {


This parser is only used for testing. Should we move it to a test-only class? The method could be a utility that would receive a OvalParser instance and the File location. Since it keeps all in memory, I think it is risky to have in the main class when is used only for testing.

rjmateus · 2025-08-11T13:32:33Z

java/code/src/com/suse/oval/parser/OvalParser.java

+     * @param ovalFile an XML file containing OVAL definitions to be parsed.
+     * @return all OVAL definitions in {@code ovalFile}
+     * */
+    public List<DefinitionType> parseAllDefinitions(File ovalFile) {


This is a dependency for the parser function that is used only for testing. We want people to use the bulk parser, and not the one that loads everything to memory.

rjmateus · 2025-08-11T13:34:27Z

java/code/src/com/redhat/rhn/manager/audit/CVEAuditManagerOVAL.java

+        OvalParser ovalParser = new OvalParser();
+        OVALResources ovalResources = ovalParser.parseResources(ovalFile);
+        ovalParser.parseDefinitionsInBulk(ovalFile, definitionsBulk -> {
+            OvalRootType ovalRoot = new OvalRootType();


Looks to me that the product.getOsFamily() and product.getOsVersion() should also be use to set the OvalRootType.
In the method called savePlatformsVulnerablePackages the OS family and version are being loaded from the OvalRootType but looks to me that it's never set.

github-actions · 2025-10-11T02:12:26Z

This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 10 days.

github-actions · 2025-12-11T02:47:51Z

This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 10 days.

github-actions · 2026-02-10T03:45:13Z

This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 10 days.

github-actions bot added java java_lint_checkstyle java_pgsql_tests API schema_migration_test_pgsql database schema_migration_test_oracle ui javascript_lint data-model xmlrpc old-ui labels Sep 7, 2023

github-actions bot added the needs-translation label Sep 7, 2023

github-advanced-security bot found potential problems Sep 7, 2023

View reviewed changes

java/code/src/com/suse/oval/OvalParser.java Fixed Show fixed Hide fixed

HoussemNasri force-pushed the oval-stax-parser branch from 8dc2d93 to 6d6dc0f Compare September 14, 2023 17:10

github-advanced-security bot found potential problems Sep 17, 2023

View reviewed changes

java/code/src/com/suse/oval/parser/OvalParser.java Fixed Show fixed Hide fixed

java/code/src/com/suse/oval/parser/OvalParser.java Fixed Show fixed Hide fixed

HoussemNasri force-pushed the oval-stax-parser branch from a279e94 to 7a5f2c7 Compare September 17, 2023 18:01

HoussemNasri mentioned this pull request Sep 24, 2023

[WIP][GSOC23] - E - Update CVE Audit documentation uyuni-project/uyuni-docs#2471

Merged

2 tasks

HoussemNasri mentioned this pull request Oct 25, 2023

[GSOC23] - A - Implement a fully functional CVE auditing feature based on OVAL data #7466

Merged

17 tasks

github-advanced-security bot found potential problems Oct 26, 2023

View reviewed changes

java/code/src/com/suse/oval/parser/OvalParser.java Fixed Show fixed Hide fixed

java/code/src/com/suse/oval/parser/OvalParser.java Fixed Show fixed Hide fixed

github-actions bot added the Stale label Dec 26, 2023

github-actions bot closed this Jan 5, 2024

mcalmer reopened this Jan 5, 2024

HoussemNasri added 9 commits April 22, 2025 10:16

Fix typo in comment

97c929a

Add ON DELETE CASCADE to suseOVALPlatformVulnerablePackage.suseOVALOs…

4421e6a

…Product foreign key

Ensure SQL migration script in idempotent

cf74911

Be more resilient in face of errors

2f4a51f

Resolve potential XML XXE vulnerability

9f483e4

Add changelogs

1089697

Fix trailing whitespace in changelog

0dfdfd4

Fix some sonar warnings

6e00c71

Use stax2-api

a67b5a2

parlt91 force-pushed the oval-stax-parser branch from b14baa8 to 3cc429f Compare April 22, 2025 08:18

parlt91 added 2 commits April 22, 2025 11:51

Fix sonarcloud issues

87801c6

Signed-off-by: Pascal Arlt <parlt@suse.com>

Move schema migration file

2d2c980

Signed-off-by: Pascal Arlt <parlt@suse.com>

parlt91 force-pushed the oval-stax-parser branch from 3cc429f to 2d2c980 Compare April 22, 2025 09:51

admd requested review from mackdk and rjmateus and removed request for rjpmestre May 20, 2025 09:52

github-actions bot added the Stale label Jul 20, 2025

rjmateus removed the Stale label Jul 21, 2025

rjmateus reviewed Aug 11, 2025

View reviewed changes

github-actions bot added the Stale label Oct 11, 2025

parlt91 removed the Stale label Oct 11, 2025

github-actions bot added the Stale label Dec 11, 2025

rjmateus removed the Stale label Dec 11, 2025

github-actions bot added the Stale label Feb 10, 2026

admd removed the Stale label Feb 10, 2026

Conversation

HoussemNasri commented Sep 7, 2023 • edited by galaxy-ci Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR change?

Useful Links

GUI diff

Documentation

Test coverage

Links

Changelogs

Re-run a test

Uh oh!

github-actions bot commented Sep 7, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 26, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Dec 26, 2023

Uh oh!

github-actions bot commented Jan 5, 2024

Uh oh!

mcalmer commented Jan 5, 2024

Uh oh!

HoussemNasri commented Jan 5, 2024

Uh oh!

mcalmer commented Jan 5, 2024

Uh oh!

github-actions bot commented Jul 20, 2025

Uh oh!

admd commented Jul 29, 2025

Uh oh!

rjmateus Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

rjmateus Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

rjmateus Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

rjmateus Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

rjmateus Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Oct 11, 2025

Uh oh!

github-actions bot commented Dec 11, 2025

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

HoussemNasri commented Sep 7, 2023 •

edited by galaxy-ci

Loading

github-actions bot commented Sep 7, 2023 •

edited

Loading

github-actions bot commented Oct 26, 2023 •

edited

Loading