Skip to content

Fix retrieval of remote source logos in GeoNetwork harvesters. - #9187

Draft
josegar74 wants to merge 4 commits into
geonetwork:mainfrom
GeoCat:fix-gnharvestersourceslogos
Draft

Fix retrieval of remote source logos in GeoNetwork harvesters.#9187
josegar74 wants to merge 4 commits into
geonetwork:mainfrom
GeoCat:fix-gnharvestersourceslogos

Conversation

@josegar74

Copy link
Copy Markdown
Member

Logo retrieval was assuming that the logos extension was gif only, which is not the case, png and jpg formats are allowed also.

Checklist

  • I have read the contribution guidelines
  • Pull request provided for main branch, backports managed with label
  • Good housekeeping of code, cleaning up comments, tests, and documentation
  • Clean commit history broken into understandable chucks, avoiding big commits with hundreds of files, cautious of reformatting and whitespace changes
  • Clean commit messages, longer verbose messages are encouraged
  • API Changes are identified in commit messages
  • Testing provided for features or enhancements using automatic tests
  • User documentation provided for new features or enhancements in manual
  • Build documentation provided for development instructions in README.md files
  • Library management using pom.xml dependency management. Update build documentation with intended library use and library tutorials or documentation

Logo retrieval was assuming that the logos extension was gif only
@josegar74 josegar74 added this to the 4.4.10 milestone Feb 26, 2026
@josegar74 josegar74 added the bug label Feb 26, 2026
Comment thread common/src/main/java/org/fao/geonet/utils/XmlRequest.java Fixed

@fxprunayre fxprunayre left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks fine. Can be tested with https://sextant.ifremer.fr/geonetwork/images/logos/b08fe709-1ced-4a07-8edf-06aa6ccdf2e3.gif vs https://sextant.ifremer.fr/geonetwork/images/logos/b08fe709-1ced-4a07-8edf-06aa6ccdf2e3.png

At some point, maybe we should consider adding a dedicated endpoint for source logo retrieval without relying on image extension.

@juanluisrp juanluisrp left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There ia a security issue in this code.

Comment thread common/src/main/java/org/fao/geonet/utils/XmlRequest.java Fixed
@josegar74

Copy link
Copy Markdown
Member Author

@juanluisrp I have added in the harvester code to check that the logo doesn't contain bad path characters. See 4a6ef4b

I haven't update XmlRequest. For that we can do another pull request, probably sending also a base path so the code checks that the file path is inside the base path.

@josegar74

Copy link
Copy Markdown
Member Author

@juanluisrp please check the latest commit: 8e53529

@josegar74 josegar74 modified the milestones: 4.4.10, 4.4.12 Jun 6, 2026
@fxprunayre fxprunayre modified the milestones: 4.4.12, 4.4.13 Jul 8, 2026
@josegar74
josegar74 marked this pull request as draft July 17, 2026 11:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants