Thanks @Ludo for providing us with extensive information about your dependencies.
In short, to be safe:
- As a rule, you should use a URL without redirection for your DTD, e.g.
https://hibernate.org/dtd/hibernate-mapping-3.0.dtd. This will, however, lead to downloading the DTD from the internet on startup, except on very recent versions of Hibernate ORM (HHH-15094).
- If you use a reasonably recent version of Hibernate ORM (4+) and do not use
hbm2java, then you can use
http://www.hibernate.org/dtd/hibernate-mapping-3.0.dtd safely (it won’t be downloaded from the internet).
The problem is caused by Xerces parsing the comment at the start of the DTD file incorrectly, but only when there is an HTTP redirection to get the DTD, and the redirected URL uses HTTPS. Don’t ask me why, I gave up on understanding the code of Xerces.
On new versions of Hibernate ORM (4+, I think?), we have a thing called
LocalXmlResourceResolver which will skip the download of the DTD when you use a known DTD URL in your XML file.
http://www.hibernate.org/dtd/hibernate-mapping-3.0.dtd is one of the recognized URLs, so that URL will always work fine on ORM 4+, even if the server goes down or adds problematic HTTP redirections.
However, if you use another DTD URL that is not recognized by
https://hibernate.org/dtd/hibernate-mapping-3.0.dtd), then Xerces will attempt to download the DTD, and in case there is a redirection to HTTPS, it will fail miserably.
hbm2java, I suspect it doesn’t use
LocalXmlResourceResolver and thus is affected by the Xerces bug regardless of the DTD URL (as soon as there’s a redirection, it will fail).
I created a ticket on Hibernate ORM to support more URLs in
LocalXmlResourceResolver, in particular HTTPS URLs: [HHH-15094] - Hibernate JIRA
I also created a ticket on Hibernate Tools to make use of
LocalXmlResourceResolver: [HBX-2307] - Hibernate JIRA
Once those two tickets are fixed, on recent Hibernate ORM or Hibernate Tools versions, the solution will become "use whatever hibernate.org URL you want, it will just use a local file.
Also, for future reference: I reproduced the DTD redirection bug on the following branch: GitHub - yrodiere/hibernate-test-case-templates at dtd-redirection-reproducer