Ensure consistent XML parser config

api/src/org/labkey/api/query/CrosstabView.java

@@ -63,10 +63,10 @@ public static List<Pair<CrosstabMember, List<DisplayColumn>>> columnsByMember(Co
     {
         List<Pair<CrosstabMember, List<DisplayColumn>>> groupedByMember = new ArrayList<>();
 
-        CrosstabMember currentMember = null;
         List<DisplayColumn> currentMemberColumns = new ArrayList<>();
-        groupedByMember.add(Pair.of(currentMember, currentMemberColumns));
+        groupedByMember.add(Pair.of(null, currentMemberColumns));
 
+        CrosstabMember currentMember = null;
         for (DisplayColumn renderer : renderers)
         {
             ColumnInfo col = renderer.getColumnInfo();
@@ -101,16 +101,22 @@ protected DataRegion createDataRegion()
         return super.createDataRegion();
     }
 
+    private CrosstabTableInfo getCrosstabTable()
+    {
+        if (!(getTable() instanceof CrosstabTableInfo table) || !table.isCrosstab())
+        {
+            throw new IllegalStateException("getTable() must return a CrosstabTableInfo but was " + getTable());
+        }
+        return table;
+    }
+
     @Override
     public List<DisplayColumn> getDisplayColumns()
     {
-        assert getTable() instanceof CrosstabTableInfo cti && cti.isCrosstab();
-
-        CrosstabTableInfo table = (CrosstabTableInfo)getTable();
-
         List<FieldKey> selectedFieldKeys = null;
+        CrosstabTableInfo table = getCrosstabTable();
 
-        // First check if something has explicitly overridden the columns
+        // First, check if something has explicitly overridden the columns
         if (_columns != null)
         {
             selectedFieldKeys = _columns;
@@ -132,11 +138,11 @@ else if (null != getCustomView())
         for (FieldKey col : selectedFieldKeys)
         {
             ColumnInfo column = table.getColumn(col);
-            if (col.getParts().get(0).startsWith(AggregateColumnInfo.NAME_PREFIX))
+            if (col.getParts().getFirst().startsWith(AggregateColumnInfo.NAME_PREFIX))
                 measureFieldKeys.add(col);
             else if (column != null && column.getCrosstabColumnMember() != null)
             {
-                List<FieldKey> fieldKeys = measureFieldKeysByMember.computeIfAbsent(column.getCrosstabColumnMember(), k -> new ArrayList<>());
+                List<FieldKey> fieldKeys = measureFieldKeysByMember.computeIfAbsent(column.getCrosstabColumnMember(), _ -> new ArrayList<>());
                 fieldKeys.add(col);
             }
             else
@@ -156,10 +162,10 @@ else if (column != null && column.getCrosstabColumnMember() != null)
                     for (FieldKey col : measureFieldKeys)
                     {
                         List<String> parts = new ArrayList<>(col.getParts());
-                        parts.set(0, AggregateColumnInfo.getColumnName(member, table.getMeasureFromKey(col.getParts().get(0))));
+                        parts.set(0, AggregateColumnInfo.getColumnName(member, table.getMeasureFromKey(col.getParts().getFirst())));
 
                         FieldKey measureMemberFieldKey = FieldKey.fromParts(parts);
-                        List<FieldKey> fieldKeys = measureFieldKeysByMember.computeIfAbsent(member, k -> new ArrayList<>());
+                        List<FieldKey> fieldKeys = measureFieldKeysByMember.computeIfAbsent(member, _ -> new ArrayList<>());
                         fieldKeys.add(measureMemberFieldKey);
                     }
                 }
@@ -195,9 +201,7 @@ public DataView createDataView()
     {
         DataView view = super.createDataView();
 
-        assert getTable() instanceof CrosstabTableInfo cti && cti.isCrosstab();
-
-        CrosstabTableInfo table = (CrosstabTableInfo)getTable();
+        CrosstabTableInfo table = getCrosstabTable();
 
         // set the default base sort (remove non-existent sort columns), merging with any existing base sort from the
         // custom view or other settings (issue 17209).

api/src/org/labkey/api/reader/SimpleXMLStreamReader.java

@@ -16,17 +16,11 @@
 
 package org.labkey.api.reader;
 
-import org.apache.logging.log4j.LogManager;
-import org.apache.logging.log4j.Logger;
-import org.labkey.api.data.BeanObjectFactory;
+import org.labkey.api.util.XmlBeansUtil;
 
-import javax.xml.stream.XMLInputFactory;
 import javax.xml.stream.XMLStreamConstants;
 import javax.xml.stream.XMLStreamException;
 import java.io.InputStream;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.regex.Pattern;
 
 /**
  * User: arauch
@@ -35,31 +29,9 @@
  */
 public class SimpleXMLStreamReader extends XMLStreamReaderWrapper
 {
-    private static final Logger _log = LogManager.getLogger(SimpleXMLStreamReader.class);
-    private static final Pattern _blankPattern = Pattern.compile("");
-
     public SimpleXMLStreamReader(InputStream stream) throws XMLStreamException
     {
-        super(getFactory().createXMLStreamReader(stream));
-    }
-
-
-    // Make sure XMLStreamReader doesn't freak if it can't resolve DTD URL
-    private static XMLInputFactory getFactory()
-    {
-        XMLInputFactory factory = XMLInputFactory.newInstance();
-        factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
-        return factory;
-    }
-
-
-    public void logElement()
-    {
-        _log.debug("----" + (getEventType() == XMLStreamConstants.END_ELEMENT ? "/" : "") + getLocalName() + "----");
-        int count = getAttributeCount();
-
-        for (int i = 0; i < count; i++)
-            _log.debug(getAttributeLocalName(i) + "=" + getAttributeValue(i));
+        super(XmlBeansUtil.XML_INPUT_FACTORY.createXMLStreamReader(stream));
     }
 
 
@@ -89,36 +61,6 @@ private boolean skipTo(String element, boolean start) throws XMLStreamException
     }
 
 
-    public String getAllText() throws XMLStreamException
-    {
-        String token = "";
-
-        // Skip until we find a character event
-        while (hasNext())
-        {
-            int event = next();
-
-            if (event == XMLStreamConstants.CHARACTERS)
-            {
-                // Characters can come in chunks... so loop until no more character events
-                while (event == XMLStreamConstants.CHARACTERS)
-                {
-                    token += getText().trim();
-
-                    if (!hasNext())
-                        break;
-
-                    event = next();
-                }
-
-                return token;
-            }
-        }
-
-        return null;
-    }
-
-
     public String getHref()
             throws XMLStreamException
     {
@@ -132,46 +74,4 @@ public String getHref()
         // UNDONE: Raise exception instead of returning null
         return null;
     }
-
-
-    public String getAllText(Pattern validationExpression) throws XMLStreamException
-    {
-        String token = getAllText();
-
-        if (validationExpression.matcher(token).matches())
-        {
-            return token;
-        }
-        else
-        {
-            _log.error("Unexpected token: " + token + " doesn't match " + validationExpression.pattern());
-            return token;
-        }
-    }
-
-
-    public void skipBlank() throws XMLStreamException
-    {
-        getAllText(_blankPattern);
-    }
-
-
-    // Creates & populates bean of the given class from XML attributes.
-    // Create and register a BeanObjectFactory for this class first, unless the default factory will do.
-    // In particular, you may need to override convertToPropertyName to convert attribute names.
-    public <K> K beanFromAttributes(Class<K> clazz)
-    {
-        Map<String, Object> m = new HashMap<>();
-        int attributeCount = getAttributeCount();
-        BeanObjectFactory<K> bof = (BeanObjectFactory<K>) BeanObjectFactory.Registry.getFactory(clazz);
-
-        for (int i = 0; i < attributeCount; i++)
-        {
-            String name = bof.convertToPropertyName(getAttributeLocalName(i));
-            String value = getAttributeValue(i);
-            m.put(name, value);
-        }
-
-        return bof.fromMap(m);
-    }
 }

api/src/org/labkey/api/util/MothershipReport.java

@@ -394,10 +394,6 @@ private HttpURLConnection openConnectionWithRedirects(URL url, @Nullable String
     private HttpURLConnection submitRequest(URL url, @Nullable String forwardedFor) throws IOException
     {
         HttpURLConnection connection = (HttpURLConnection)url.openConnection();
-        if (connection instanceof HttpsURLConnection)
-        {
-            HttpsUtil.disableValidation((HttpsURLConnection)connection);
-        }
         // We'll handle redirects on our own which makes sure that we
         // POST instead of GET after being redirected
         connection.setInstanceFollowRedirects(false);

api/src/org/labkey/api/util/XmlBeansUtil.java

@@ -117,22 +117,29 @@ public static void addStandardExportComment(XmlTokenSource doc, Container c, Use
 
     public static void addComment(XmlTokenSource doc, String comment)
     {
-        XmlCursor cursor = doc.newCursor();
-        cursor.insertComment(comment);
-        cursor.dispose();
+        try (XmlCursor cursor = doc.newCursor())
+        {
+            cursor.insertComment(comment);
+        }
     }
 
-    /** XML parsing factories preconfigured to prevent XML external entity references (XXE) */
+    /**
+     * XML parsing factories preconfigured to prevent XML external entity references (XXE).
+     * These are static and are unfortunately mutable. We could switch to a factory pattern to create
+     * freshly configured factories.
+     */
     public static final SAXParserFactory SAX_PARSER_FACTORY;
     public static final XMLInputFactory XML_INPUT_FACTORY;
     public static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY;
 
     static
     {
+        //noinspection XMLInputFactory
         XML_INPUT_FACTORY = XMLInputFactory.newInstance();
         XML_INPUT_FACTORY.setProperty(XMLInputFactory.SUPPORT_DTD, false);
         XML_INPUT_FACTORY.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
 
+        //noinspection XMLInputFactory
         SAX_PARSER_FACTORY = SAXParserFactory.newInstance();
         try
         {
@@ -147,6 +154,7 @@ public static void addComment(XmlTokenSource doc, String comment)
             SAX_PARSER_FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
             SAX_PARSER_FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
 
+            //noinspection XMLInputFactory
             DOCUMENT_BUILDER_FACTORY = DocumentBuilderFactory.newInstance();
             DOCUMENT_BUILDER_FACTORY.setNamespaceAware(true);
             DOCUMENT_BUILDER_FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

api/src/org/labkey/api/view/Portal.java

@@ -1674,7 +1674,7 @@ static Map<String, String> getPartsToAdd(Container c, String scope, String locat
 
     public static WebPartView getWebPartViewSafe(@NotNull WebPartFactory factory, @NotNull ViewContext portalCtx, @NotNull Portal.WebPart webPart)
     {
-        WebPartView view;
+        WebPartView<?> view;
 
         try
         {

core/webapp/extWidgets/SearchPanel.js

@@ -313,7 +313,7 @@ Ext4.define('LABKEY.ext4.SearchPanel', {
         //the label
         row.push({
             cls: 'search-panel-row-label',
-            html: meta.caption + ':', width: this.LABEL_WIDTH,
+            html: LABKEY.Utils.encodeHtml(meta.caption) + ':', width: this.LABEL_WIDTH,
             bodyStyle: 'background-color: transparent;'
         });
         Ext4.apply(theField, {