SIS 1.7 Release notes

Following the retirement of Apache Derby, this release migrated the org.apache.sis.referencing.database module (Maven artifact: sis-embedded-data) to HSQLDB. This change brings the following known issues (links to issues tracker are given):

  • sis-embedded-data does not work if HSQLDB is on the module-path (HSQLDB-1761).
  • sis-embedded-data causes “A terminally deprecated method in sun.misc.Unsafe has been called” warning (HSQLDB-1752).
  • sis-embedded-data may be very slow (HSQLDB-1758). As a workaround, sis-embedded-data unzips the database in a temporary directory, but this workaround may not be applicable in all environments.
  • Some command-line examples are temporarily broken because of collation issue.

Applications connected to their own database should instead use the org.apache.sis.referencing.epsg module (Maven artifact: sis-epsg) in order to leverage their existing database engine and avoid above issues. For example, Apache SIS works well on PostgreSQL.

Security

This release fixes the following vulnerabilities. Before the fixes, parsing a small crafted file could cause an OutOfMemoryError, or cause the parsing of other files at arbitrary URLs (local or distant), or allow SQL injection (org.apache.sis.storage.sql module only; the metadata and referencing modules are not impacted). Note that when Apache SIS opens another file, it tries to parse it as GML, GeoTIFF, NADCON or NTv2 format and fails at the first error. Therefore, these vulnerabilities are unlikely to leak sensitive information (unless passwords are saved as TIFF images…).

  • CWE-918 SSRF and local-file disclosure via xlink:href resolution during XML unmarshalling (reporters: n0mi1k, Ho1aAs).
  • CWE-918 SSRF via datum-shift grid-file references such as URI parameter in WKT (reporters: n0mi1k, Ho1aAs).
  • CWE-22 path traversal / arbitrary file read via Landsat metadata band filenames (reporters: n0mi1k, Ho1aAs).
  • CWE-770 unbounded memory allocation in the binary file parsers (netCDF + GeoTIFF) leading to DoS (reporter: n0mi1k).
  • SQL injection via unvalidated ORDER BY sort expression in the SQL feature store (reporter: Ho1aAs).

The following vulnerability has not been fixed by code. Instead, it is addressed by documenting recommendations:

  • SQL injection on MySQL/MariaDB via missing backslash escaping (reporter: Ho1aAs).

See the Security Policy for recommendations about how to use Apache SIS in a security-sensitive context. Thanks to “n0mi1k Security” and to Ho1aAs (GitHub: @HolaAsuka) for these reports.

Incompatible changes

The following changes in Apache SIS 1.7 are incompatibles with the previous release (SIS 1.6):

  • JoinFeatureSet.condition field has been made private because it was exposing a non-public type.
  • StoreListener.eventOccured(…) method has been renamed eventOccurred(…) (fixed a typo in method name).
  • RecentReferenceSystems.setGridReferencing(…) argument changed: Map keys changed from String to Identifier.
  • xlink:href attributes in XML files are no longer followed by default if the referenced file is not in the same directory, or in a sub-directory, of the document containing the reference (see above security section). For following all URLs as before, set the XML.RESOLVER property to ReferenceResolver.FOLLOW_EXTERNAL_XLINK.

Noticeable changes

Non-exhaustive list:

New Features

  • SIS-636 — Provide a HEIF data store
  • SIS-635 — Write quasi-COG (Cloud Optimized GeoTIFF)

Improvements

  • SIS-626 — GeoTIFF reader should implement TiledGridResource interface

Bug fixes

  • SIS-637 — EPSGFactory triggers full GCs
  • SIS-630 — NoClassDefFoundError: org/apache/derby/iapi/jdbc/EmbeddedDataSourceInterface when using sis-embedded-data
  • SIS-629 — DateTimeParseException in EPSGDataAccess.getOptionalTemporal when iterating EPSG GeographicCRS codes
  • SIS-628 — Pyramid level order should be from coarsest to finest resolution
  • SIS-627 — JVM crash if two or more GDALStoreProvider are created with explicit path to GDAL native library
  • SIS-632 — NotSerializableException during CRS serialization
  • SIS-625 — GDAL library not loaded on MacOS
  • #48 — Fix GeoTIFF localization grid when tie points are rectilinear but unevenly spaced
  • #43 — Fix getting tiles from a 3D tiled grid coverage using ImageTileMatrix class
  • #45 — Incorrect column type for timestamp with timezone in PostgreSQL

Tasks

  • SIS-633 — Move OptionKey to the storage module
  • SIS-631 — Migrate EPSG dataset from Derby to another database
  • #44 — Fix an instability in GeoTIFF unit test