Skip to content

Prevent XML xxe on Strict HL7 parsing - #406

Closed
mgaffigan wants to merge 2 commits into
OpenIntegrationEngine:mainfrom
mgaffigan:fix/hl7-permits-xml-by-default
Closed

Prevent XML xxe on Strict HL7 parsing#406
mgaffigan wants to merge 2 commits into
OpenIntegrationEngine:mainfrom
mgaffigan:fix/hl7-permits-xml-by-default

Conversation

@mgaffigan

@mgaffigan mgaffigan commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Avoids any possibility of XXE by not accepting XML input on a channel to receive HL7. Turns the message into an error - just as it would be for any other invalid format.

ER7Serializer error
ERROR MESSAGE: Error converting ER7 to XML
ca.uhn.hl7v2.parser.EncodingNotSupportedException: Determine encoding for message. The following is the first 50 chars of the message for reference, although this may not be where the issue is: <?xml version="1.0"?>
...

Breaking change for anyone relying on being able to send XML to a channel configured to receive HL7. Opt-out of the new behavior by toggling "Allow XML" in the datatype properties.

image

Thanks to Samuel Paschuan for reporting the issue.

@github-actions

github-actions Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Test Results

124 files  ±0  124 suites  ±0   2m 46s ⏱️ +48s
700 tests +2  700 ✅ +2  0 💤 ±0  0 ❌ ±0 
724 runs  +2  724 ✅ +2  0 💤 ±0  0 ❌ ±0 

Results for commit dd17abb. ± Comparison against base commit 1e87457.

♻️ This comment has been updated with latest results.

jonbartels
jonbartels requested changes Aug 10, 2026
View reviewed changes
Comment thread server/src/test/java/com/mirth/connect/plugins/datatypes/hl7v2/ER7SerializerTest.java
Comment thread server/src/test/java/com/mirth/connect/plugins/datatypes/hl7v2/ER7SerializerTest.java Outdated
Comment thread server/src/main/java/com/mirth/connect/plugins/datatypes/hl7v2/ER7Serializer.java
Message message = null;
source = source.trim();

if (source.length() > 0 && source.charAt(0) == '<') {

@jonbartels jonbartels Aug 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-blocking - How can this be documented in the release notes?

@pacmano1 pacmano1 mentioned this pull request Aug 10, 2026
Merged
@Huggy56 Huggy56 mentioned this pull request Sep 14, 2026
Closed
@mgaffigan
mgaffigan force-pushed the fix/hl7-permits-xml-by-default branch from dcb2781 to d5eec04 Compare September 21, 2026 20:56
@mgaffigan
mgaffigan marked this pull request as ready for review September 21, 2026 20:56
@pacmano1 pacmano1 mentioned this pull request Sep 22, 2026
Open
@jonbartels jonbartels added this to the 4.6.x CVE fixes milestone Sep 23, 2026
@jonbartels jonbartels added the 4.6.x CVE Fixes A quick way to organize a batch of CVE issues for 4.6.x, Sept 2026 label Sep 23, 2026
@jonbartels
jonbartels force-pushed the fix/hl7-permits-xml-by-default branch from fda859b to 3083a72 Compare September 23, 2026 19:58
mgaffigan and others added 2 commits September 23, 2026 15:58
@mgaffigan @jonbartels
Prevent XML xxe on HL7 parsing
66e53ec 
Signed-off-by: Mitch Gaffigan <mitch.gaffigan@comcast.net>
@jonbartels
Minor test fixups for PR 406
dd17abb 
Signed-off-by: Jon Bartels <jonathan.bartels@gmail.com>
@jonbartels
jonbartels force-pushed the fix/hl7-permits-xml-by-default branch from 3083a72 to dd17abb Compare September 23, 2026 19:58
@mgaffigan mgaffigan closed this Sep 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jonbartels jonbartels jonbartels approved these changes
@kayyagari kayyagari Awaiting requested review from kayyagari kayyagari is a code owner automatically assigned from OpenIntegrationEngine/maintainers
@gibson9583 gibson9583 Awaiting requested review from gibson9583 gibson9583 is a code owner automatically assigned from OpenIntegrationEngine/maintainers
@ssrowe ssrowe Awaiting requested review from ssrowe ssrowe is a code owner automatically assigned from OpenIntegrationEngine/maintainers
@kpalang kpalang Awaiting requested review from kpalang kpalang is a code owner automatically assigned from OpenIntegrationEngine/maintainers
@NicoPiel NicoPiel Awaiting requested review from NicoPiel NicoPiel is a code owner automatically assigned from OpenIntegrationEngine/maintainers
@tonygermano tonygermano Awaiting requested review from tonygermano tonygermano is a code owner automatically assigned from OpenIntegrationEngine/maintainers

Assignees

No one assigned

Labels

4.6.x CVE Fixes A quick way to organize a batch of CVE issues for 4.6.x, Sept 2026

Projects

None yet

Milestone

Next Release

Development

Successfully merging this pull request may close these issues.

2 participants

@mgaffigan @jonbartels