The markup declarations contained or pointed to by the document type declaration must be well-formed

Hibernate ORM
28

Thanks @Ludo for providing us with extensive information about your dependencies.

In short, to be safe:

  • As a rule, you should use a URL without redirection for your DTD, e.g. https://hibernate.org/dtd/hibernate-configuration-3.0.dtd or https://hibernate.org/dtd/hibernate-mapping-3.0.dtd. This will, however, lead to downloading the DTD from the internet on startup, except on very recent versions of Hibernate ORM (HHH-15094).
  • If you use a reasonably recent version of Hibernate ORM (4+) and do not use hbm2java, then you can use http://www.hibernate.org/dtd/hibernate-configuration-3.0.dtd/http://www.hibernate.org/dtd/hibernate-mapping-3.0.dtd safely (it won’t be downloaded from the internet).

Explanation follows.

The problem is caused by Xerces parsing the comment at the start of the DTD file incorrectly, but only when there is an HTTP redirection to get the DTD, and the redirected URL uses HTTPS. Don’t ask me why, I gave up on understanding the code of Xerces.

On new versions of Hibernate ORM (4+, I think?), we have a thing called LocalXmlResourceResolver which will skip the download of the DTD when you use a known DTD URL in your XML file. http://www.hibernate.org/dtd/hibernate-mapping-3.0.dtd is one of the recognized URLs, so that URL will always work fine on ORM 4+, even if the server goes down or adds problematic HTTP redirections.

However, if you use another DTD URL that is not recognized by LocalXmlResourceResolver (including https://hibernate.org/dtd/hibernate-mapping-3.0.dtd), then Xerces will attempt to download the DTD, and in case there is a redirection to HTTPS, it will fail miserably.

As to hbm2java, I suspect it doesn’t use LocalXmlResourceResolver and thus is affected by the Xerces bug regardless of the DTD URL (as soon as there’s a redirection, it will fail).

I created a ticket on Hibernate ORM to support more URLs in LocalXmlResourceResolver, in particular HTTPS URLs: [HHH-15094] - Hibernate JIRA

I also created a ticket on Hibernate Tools to make use of LocalXmlResourceResolver: [HBX-2307] - Hibernate JIRA

Once those two tickets are fixed, on recent Hibernate ORM or Hibernate Tools versions, the solution will become "use whatever hibernate.org URL you want, it will just use a local file.

Also, for future reference: I reproduced the DTD redirection bug on the following branch: GitHub - yrodiere/hibernate-test-case-templates at dtd-redirection-reproducer

2 Likes