Answer XML-RPC with Roller's own server and drop Apache XML-RPC

CHANGES.md

@@ -97,6 +97,21 @@
 
 ### Behaviour changes worth reading before upgrading
 
+- **Blogger and MetaWeblog requests have a size limit.** Roller now answers
+  XML-RPC itself instead of through Apache XML-RPC. Clients see the same
+  methods, faults and fault codes, but a request larger than 1 MiB is
+  refused with HTTP 413. While uploads are on, the limit is raised to fit
+  the largest allowed upload as base64, up to 32 MiB, so a file larger
+  than about 23 MB has to be uploaded in the media library instead of
+  through a blog client. The limit also applies to the
+  decompressed size of a gzip-encoded request. Only the standard XML-RPC
+  value types are accepted.
+  Two other differences: characters outside the Basic Multilingual Plane,
+  such as emoji, are now sent as valid XML (the old library wrote each
+  surrogate half as its own reference, which clients rejected), and stored
+  carriage returns are now sent as `
`, so clients receive line breaks
+  as stored rather than normalised to `\n`.
+
 - **Themes from Roller 5.0 or earlier may need updating.** Roller 5.1 removed
   the pre-3.0 macros in `WEB-INF/velocity/deprecated/`, such as
   `#showWeblogEntries` and `#showBookmarks`, and referrer macros such as
@@ -132,6 +147,9 @@
 
 ### Build and packaging
 
+- Apache XML-RPC (`xmlrpc-common`, `xmlrpc-server`) and `ws-commons-util`
+  are no longer shipped. Apache XML-RPC is end of life, and 3.1.3 has an
+  unfixed denial-of-service issue (CVE-2016-5004).
 - Third-party libraries are updated to their latest patch and minor releases,
   among them Struts 7.4.0, Spring 7.0.10 and Spring Security 7.1.2. OGNL is
   pinned to 3.4.17, which fixes CVE-2026-113730.

app/pom.xml

@@ -61,8 +61,6 @@ limitations under the License.
         <bootstrap.version>5.3.8</bootstrap.version>
         <bootstrap-icons.version>1.13.2</bootstrap-icons.version>
         <velocity.version>2.4.1</velocity.version>
-        <ws-commons-util.version>1.0.2</ws-commons-util.version>
-        <xmlrpc-version>3.1.3</xmlrpc-version>
     </properties>
 
     <dependencies>
@@ -402,47 +400,6 @@ limitations under the License.
             <version>${commons-secure-xml.version}</version>
         </dependency>
 
-        <dependency>
-            <groupId>org.apache.xmlrpc</groupId>
-            <artifactId>xmlrpc-common</artifactId>
-            <version>${xmlrpc-version}</version>
-        </dependency>
-
-        <!-- Still needed: RollerXmlRpcServlet/RollerXmlRpcServletServer use
-             server-side classes (PropertyHandlerMapping, XmlRpcHttpServer, etc.)
-             that live in this artifact. The servlet classes themselves have been
-             forked into Roller so their javax.servlet imports can be migrated
-             to jakarta.servlet in Phase 2. TODO ROL-2183: evaluate whether
-             these server classes can also be forked to fully drop this dep. -->
-        <dependency>
-            <groupId>org.apache.xmlrpc</groupId>
-            <artifactId>xmlrpc-server</artifactId>
-            <version>${xmlrpc-version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>commons-logging</groupId>
-                    <artifactId>commons-logging</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-
-        <dependency>
-            <groupId>org.apache.ws.commons.util</groupId>
-            <artifactId>ws-commons-util</artifactId>
-            <version>${ws-commons-util.version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>xml-apis</groupId>
-                    <artifactId>xml-apis</artifactId>
-                </exclusion>
-                <!-- has a compile scope dependency to junit for some reason -->
-                <exclusion>
-                    <groupId>junit</groupId>
-                    <artifactId>junit</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-
 
         <!-- Spring deps (needed only for Spring Security) -->
 

app/src/main/java/org/apache/roller/weblogger/business/WebloggerImpl.java

@@ -27,7 +27,6 @@
 import org.apache.roller.weblogger.business.runnable.ThreadManager;
 import org.apache.roller.weblogger.business.search.IndexManager;
 import org.apache.roller.weblogger.business.themes.ThemeManager;
-import org.apache.roller.weblogger.util.SecureXmlParsers;
 
 
 import java.io.IOException;
@@ -296,10 +295,6 @@ public void initialize() throws InitializationException {
         getIndexManager().initialize();
         getMediaFileManager().initialize();
 
-        // XML-RPC requests are parsed with Roller's standard parser
-        // configuration. If it cannot be applied, startup fails.
-        SecureXmlParsers.installForXmlRpc();
-
         // we always need to do a flush after initialization because it's
         // possible that some changes need to be persisted
         try {

app/src/main/java/org/apache/roller/weblogger/util/SecureXmlParsers.java

@@ -23,7 +23,6 @@
 import javax.xml.parsers.SAXParserFactory;
 
 import org.apache.commons.xml.secure.SecureSAXParserFactory;
-import org.apache.xmlrpc.util.SAXParsers;
 import org.jdom2.JDOMException;
 import org.jdom2.input.sax.XMLReaderJDOMFactory;
 import org.xml.sax.SAXException;
@@ -82,13 +81,4 @@ public static SAXParserFactory newSAXParserFactory() {
         }
         return factory;
     }
-
-    /**
-     * Makes the XML-RPC library parse requests with {@link #newSAXParserFactory()}.
-     *
-     * @throws IllegalStateException if the configuration cannot be applied
-     */
-    public static void installForXmlRpc() {
-        SAXParsers.setSAXParserFactory(newSAXParserFactory());
-    }
 }

app/src/main/java/org/apache/roller/weblogger/util/XmlCharacters.java

@@ -0,0 +1,59 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ *  contributor license agreements.  The ASF licenses this file to You
+ * under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.  For additional information regarding
+ * copyright in this work, please see the NOTICE file in the top level
+ * directory of this distribution.
+ */
+
+package org.apache.roller.weblogger.util;
+
+/**
+ * Text that Roller writes into XML documents it generates itself.
+ */
+public final class XmlCharacters {
+
+    private XmlCharacters() {
+    }
+
+    /**
+     * Drops the characters that XML 1.0 does not allow in a document (most
+     * control characters, U+FFFE, U+FFFF and unpaired surrogates). Stored
+     * text can contain them, and a single one makes the whole response
+     * unreadable for a client.
+     *
+     * @return the text without those characters, or null for null
+     */
+    public static String withoutIllegalCharacters(String text) {
+        if (text == null) {
+            return null;
+        }
+        StringBuilder out = null;
+        int i = 0;
+        while (i < text.length()) {
+            int cp = text.codePointAt(i);
+            int len = Character.charCount(cp);
+            boolean legal = cp == 0x9 || cp == 0xA || cp == 0xD
+                    || (cp >= 0x20 && cp <= 0xD7FF)
+                    || (cp >= 0xE000 && cp <= 0xFFFD)
+                    || (cp >= 0x10000 && cp <= 0x10FFFF);
+            if (!legal && out == null) {
+                out = new StringBuilder(text.length()).append(text, 0, i);
+            } else if (legal && out != null) {
+                out.appendCodePoint(cp);
+            }
+            i += len;
+        }
+        return out == null ? text : out.toString();
+    }
+}

app/src/main/java/org/apache/roller/weblogger/webservices/atomprotocol/AtomWriter.java

@@ -31,6 +31,8 @@
 import javax.xml.stream.XMLStreamException;
 import javax.xml.stream.XMLStreamWriter;
 
+import org.apache.roller.weblogger.util.XmlCharacters;
+
 /**
  * Serializes the AtomPub wire model ({@link AtomEntry}, {@link AtomFeed},
  * {@link AtomServiceDoc}) to XML using the JDK StAX API. Replaces the ROME and
@@ -276,32 +278,8 @@ private void writeAtomText(XMLStreamWriter w, String name, String text)
         w.writeEndElement();
     }
 
-    /**
-     * Drops the characters that XML 1.0 does not allow in a document (most
-     * control characters, U+FFFE, U+FFFF and unpaired surrogates). Stored
-     * text can contain them, and a single one makes the whole response
-     * unreadable for a client.
-     */
+    /** See {@link XmlCharacters#withoutIllegalCharacters(String)}. */
     static String xml(String text) {
-        if (text == null) {
-            return null;
-        }
-        StringBuilder out = null;
-        int i = 0;
-        while (i < text.length()) {
-            int cp = text.codePointAt(i);
-            int len = Character.charCount(cp);
-            boolean legal = cp == 0x9 || cp == 0xA || cp == 0xD
-                    || (cp >= 0x20 && cp <= 0xD7FF)
-                    || (cp >= 0xE000 && cp <= 0xFFFD)
-                    || (cp >= 0x10000 && cp <= 0x10FFFF);
-            if (!legal && out == null) {
-                out = new StringBuilder(text.length()).append(text, 0, i);
-            } else if (legal && out != null) {
-                out.appendCodePoint(cp);
-            }
-            i += len;
-        }
-        return out == null ? text : out.toString();
+        return XmlCharacters.withoutIllegalCharacters(text);
     }
 }

app/src/main/java/org/apache/roller/weblogger/webservices/xmlrpc/BaseAPIHandler.java

@@ -24,7 +24,6 @@
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.apache.xmlrpc.XmlRpcException;
 import org.apache.roller.weblogger.config.WebloggerRuntimeConfig;
 import org.apache.roller.weblogger.business.WebloggerFactory;
 import org.apache.roller.weblogger.business.UserManager;
@@ -36,7 +35,6 @@
 import org.apache.roller.weblogger.pojos.WeblogPermission;
 import org.apache.roller.weblogger.ui.core.RollerContext;
 import org.apache.roller.weblogger.util.cache.CacheManager;
-import org.apache.xmlrpc.common.XmlRpcNotAuthorizedException;
 
 /**
  * Base API handler does user validation, provides exception types, etc.

app/src/main/java/org/apache/roller/weblogger/webservices/xmlrpc/BloggerAPIHandler.java

@@ -46,7 +46,6 @@
 import org.apache.roller.weblogger.pojos.WeblogPermission;
 import org.apache.roller.weblogger.pojos.ThemeTemplate.ComponentType;
 import org.apache.roller.weblogger.util.Utilities;
-import org.apache.xmlrpc.XmlRpcException;
 
 /**
  * Weblogger XML-RPC Handler for the Blogger v1 API.

app/src/main/java/org/apache/roller/weblogger/webservices/xmlrpc/MetaWeblogAPIHandler.java

@@ -48,7 +48,6 @@
 import org.apache.roller.weblogger.ui.core.RollerContext;
 import org.apache.roller.weblogger.util.RollerMessages;
 import org.apache.roller.weblogger.util.Utilities;
-import org.apache.xmlrpc.XmlRpcException;
 
 
 /**
@@ -113,7 +112,7 @@ public Object getCategories(String blogid, String userid, String password)
      * @param password Password for said username
      * @param struct Contents of the post
      * @param publish If true, the blog will be published immediately after the post is made
-     * @throws org.apache.xmlrpc.XmlRpcException
+     * @throws XmlRpcException
      * @return
      */
     public boolean editPost(String postid, String userid, String password,
@@ -213,7 +212,7 @@ public boolean editPost(String postid, String userid, String password,
      * @param password Password for said username
      * @param struct Contents of the post
      * @param publish If true, the blog will be published immediately after the post is made
-     * @throws org.apache.xmlrpc.XmlRpcException
+     * @throws XmlRpcException
      * @return
      */
     public String newPost(String blogid, String userid, String password,