Release version 5.6.0

Author: namedgraph

Dockerfile

@@ -38,8 +38,6 @@ ENV SOURCE_COMMIT=$SOURCE_COMMIT
 
 WORKDIR $CATALINA_HOME
 
-ENV CACHE_MODEL_LOADS=true
-
 ENV STYLESHEET=static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/layout.xsl
 
 ENV CACHE_STYLESHEET=true

docker-compose.yml

@@ -107,6 +107,10 @@ services:
   fuseki-admin:
     image: atomgraph/fuseki:6.1.0
     user: root # otherwise fuseki user does not have permissions to the mounted folder which is owner by root
+    mem_limit: 1536m # leave headroom above heap for TDB mmap/native memory
+    restart: on-failure
+    environment:
+      - JAVA_OPTIONS=-Xmx768m -Xms768m
     expose:
       - 3030
     volumes:
@@ -116,6 +120,10 @@ services:
   fuseki-end-user:
     image: atomgraph/fuseki:6.1.0
     user: root # otherwise the fuseki user does not have permissions to the mounted folder which is owner by root
+    mem_limit: 3072m # leave headroom above heap for TDB mmap/native memory
+    restart: on-failure
+    environment:
+      - JAVA_OPTIONS=-Xmx1536m -Xms1536m
     expose:
       - 3030
     volumes:
@@ -384,28 +392,24 @@ configs:
               return (pass);
           }
 
-          if (req.http.Client-Cert) {
-              # Authenticated HTML is user-specific → never cache
-              if (req.http.Accept ~ "text/html" ||
-                  req.http.Accept ~ "application/xhtml+xml") {
-                  return (pass);
-              }
-
-              # Conditional requests must reach backend for validation
-              if (req.http.If-Match || req.http.If-None-Match ||
-                  req.http.If-Modified-Since || req.http.If-Unmodified-Since) {
-                  return (pass);
-              }
-
-              # /access endpoint returns agent-specific group memberships
-              if (req.url ~ "^/access") {
-                  return (pass);
-              }
+          # Delegated requests carry user identity in the On-Behalf-Of header.
+          # The backend response echoes that identity in the Link header
+          # (acl#agent). The cache key does not include the asserted identity,
+          # so caching would let a later anonymous request to the same
+          # URL+Accept read back the previous agent's WebID and ACL grant.
+          if (req.http.On-Behalf-Of) {
+              return (pass);
+          }
 
-              # SPARQL referencing /acl/agents/ depends on agent identity → don't cache
-              if (req.url ~ "%2Facl%2Fagents%2F") {
-                  return (pass);
-              }
+          # Authenticated responses get acl#agent stamped into the Link header by
+          # the backend, regardless of representation (HTML, RDF/XML, Turtle,
+          # JSON-LD, SPARQL results, …). The URL-keyed cache slot ignores the
+          # asserting identity, so any such response would leak to anonymous
+          # readers of the same URL. /static/* is the only safely-shared path —
+          # it's served by Tomcat's default servlet (web.xml:365-371), bypasses
+          # Jersey, and carries no identity-bearing headers.
+          if (req.http.Client-Cert && req.url !~ "^/static/") {
+              return (pass);
           }
 
           if (req.http.Cookie) {

http-tests/document-hierarchy/GET-namespace-forClass-rdfs.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
+initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# sp:Describe is declared only as rdfs:Class (not owl:Class) in sp.ttl.
+# OntologyFilter must promote rdfs:Class to owl:Class during materialization so
+# that OWL2 profiles recognise third-party vocab terms and return their SPIN constructors.
+
+response=$(curl -k -f -s \
+  -G \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -H "Accept: application/rdf+xml" \
+  --data-urlencode "forClass=http://spinrdf.org/sp#Describe" \
+  "${END_USER_BASE_URL}ns")
+
+# response must be non-empty: sp:Describe must be recognised as an OntClass
+echo "$response" | grep -q "http://spinrdf.org/sp#Describe"

http-tests/document-hierarchy/PATCH-blank-node-skolemized.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
+initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# add agent to the writers group
+
+add-agent-to-group.sh \
+  -f "$OWNER_CERT_FILE" \
+  -p "$OWNER_CERT_PWD" \
+  --agent "$AGENT_URI" \
+  "${ADMIN_BASE_URL}acl/groups/writers/"
+
+# PATCH the root with an INSERT that introduces a blank node.
+# Use rdf:_99 to avoid colliding with existing rdf:_1..rdf:_8 in the test dataset.
+# Expected: 204 No Content; the blank node is skolemized to a hash URI before persisting.
+
+update=$(cat <<EOF
+PREFIX  rdf:  <http://www.w3.org/1999/02/22-rdf-syntax-ns#>
+PREFIX  dct:  <http://purl.org/dc/terms/>
+
+INSERT
+{
+  <${END_USER_BASE_URL}> rdf:_99 _:bnode0 .
+  _:bnode0 dct:title "Blank node title"
+}
+WHERE
+{}
+EOF
+)
+
+curl -k -w "%{http_code}\n" -o /dev/null -f -s \
+  -E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
+  -X PATCH \
+  -H "Content-Type: application/sparql-update" \
+  "$END_USER_BASE_URL" \
+   --data-binary "$update" \
+| grep -q "$STATUS_NO_CONTENT"
+
+# fetch the persisted graph and verify the blank node was skolemized to a hash URI
+
+response=$(curl -k -f -s -G \
+  -E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
+  -H "Accept: application/n-triples" \
+  "$END_USER_BASE_URL")
+
+rdf_99_line=$(echo "$response" | grep -E "^<${END_USER_BASE_URL}> <http://www.w3.org/1999/02/22-rdf-syntax-ns#_99>" || true)
+
+[ -n "$rdf_99_line" ] || exit 1
+
+# object of rdf:_99 must be a URI (<...>), not a blank node label (_:...)
+! echo "$rdf_99_line" | grep -qE '_:[A-Za-z0-9]+ \.$'
+echo "$rdf_99_line" | grep -qE '<\S+> \.$'

http-tests/proxy/GET-proxied-no-cache-poisoning.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Regression: ProxyRequestFilter's server-side fetch attaches On-Behalf-Of
+# (via WebIDDelegationFilter), and the backend response carries the asserted
+# agent's WebID in the Link header (acl#agent). varnish-frontend must not
+# cache that response under a URL-keyed entry — otherwise a subsequent
+# anonymous request to the same URL+Accept replays the cached 200 and reads
+# back the previous agent's identity (and inherits whatever ACL grant they
+# had).
+
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# Step A: authenticated owner fires a proxy request from the end-user
+# dataspace to the admin dataspace. This triggers WebIDDelegationFilter →
+# On-Behalf-Of on the server-side hop into varnish-frontend.
+
+curl -k -f -s -o /dev/null \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -G \
+  -H 'Accept: application/rdf+xml' \
+  --data-urlencode "uri=${ADMIN_BASE_URL}" \
+  "${END_USER_BASE_URL}"
+
+# Step B: anonymous direct request to the admin URL with the same Accept.
+# If the cache was poisoned in Step A, this returns 200 with the owner's
+# WebID in the Link header. Expected after the fix: varnish-frontend should
+# pass on On-Behalf-Of and store nothing, so this goes to the backend
+# anonymously and gets 403.
+
+response=$(curl -k -s -i -H 'Accept: application/rdf+xml' "${ADMIN_BASE_URL}")
+
+status=$(printf '%s\n' "$response" | awk 'NR==1{print $2}' | tr -d '\r')
+link_leak=$(printf '%s\n' "$response" | tr -d '\r' | grep -i '^link:' | grep -c 'acl#agent' || true)
+
+if [ "$status" != "$STATUS_FORBIDDEN" ]; then
+    echo "Step B: expected $STATUS_FORBIDDEN, got $status"
+    exit 1
+fi
+
+if [ "$link_leak" != "0" ]; then
+    echo "Step B: anonymous response leaks acl#agent (cache poisoning)"
+    exit 1
+fi
+
+# Step C: authenticated owner fetches the admin URL directly with cert at TLS,
+# Accept: application/rdf+xml. The Client-Cert header reaches varnish-frontend
+# (nginx-forwarded). The backend stamps acl#agent into the Link header for the
+# authenticated 200. varnish-frontend must NOT cache this response — its hash
+# key ignores identity, so a subsequent anonymous request would replay the 200.
+
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+curl -k -f -s -o /dev/null \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -H 'Accept: application/rdf+xml' \
+  "${ADMIN_BASE_URL}"
+
+# Step D: anonymous direct fetch of the same URL. With the fix in place
+# (Client-Cert + non-/static/ path → pass in vcl_recv), Step C didn't store
+# anything, so this reaches the backend anonymously and gets 403.
+
+response=$(curl -k -s -i -H 'Accept: application/rdf+xml' "${ADMIN_BASE_URL}")
+
+status=$(printf '%s\n' "$response" | awk 'NR==1{print $2}' | tr -d '\r')
+link_leak=$(printf '%s\n' "$response" | tr -d '\r' | grep -i '^link:' | grep -c 'acl#agent' || true)
+
+if [ "$status" != "$STATUS_FORBIDDEN" ]; then
+    echo "Step D: expected $STATUS_FORBIDDEN, got $status"
+    exit 1
+fi
+
+if [ "$link_leak" != "0" ]; then
+    echo "Step D: anonymous response leaks acl#agent (cache poisoning)"
+    exit 1
+fi

platform/context.xsl

@@ -17,7 +17,6 @@ xmlns:orcid="&orcid;"
 
     <xsl:output method="xml" indent="yes"/>
 
-    <xsl:param name="a:cacheModelLoads"/>
     <xsl:param name="ac:stylesheet"/>
     <xsl:param name="ac:cacheStylesheet"/>
     <xsl:param name="ac:resolvingUncached"/>
@@ -66,9 +65,6 @@ xmlns:orcid="&orcid;"
         <xsl:copy>
             <xsl:apply-templates select="@*"/>
 
-            <xsl:if test="$a:cacheModelLoads">
-                <Parameter name="&a;cacheModelLoads" value="{$a:cacheModelLoads}" override="false"/>
-            </xsl:if>
             <xsl:if test="$ac:stylesheet">
                 <Parameter name="&ac;stylesheet" value="{$ac:stylesheet}" override="false"/>
             </xsl:if>

platform/entrypoint.sh

@@ -1043,10 +1043,6 @@ if [ -n "$PROXY_PORT" ]; then
     PROXY_PORT_PARAM="--stringparam ldhc:proxyPort '$PROXY_PORT' "
 fi
 
-if [ -n "$CACHE_MODEL_LOADS" ]; then
-    CACHE_MODEL_LOADS_PARAM="--stringparam a:cacheModelLoads '$CACHE_MODEL_LOADS' "
-fi
-
 # stylesheet URL must be relative to the base context URL
 if [ -n "$STYLESHEET" ]; then
     STYLESHEET_PARAM="--stringparam ac:stylesheet '$STYLESHEET' "
@@ -1166,7 +1162,6 @@ fi
 
 transform="xsltproc \
   --output conf/Catalina/localhost/ROOT.xml \
-  $CACHE_MODEL_LOADS_PARAM \
   $STYLESHEET_PARAM \
   $CACHE_STYLESHEET_PARAM \
   $RESOLVING_UNCACHED_PARAM \

pom.xml

@@ -3,7 +3,7 @@
 
     <groupId>com.atomgraph</groupId>
     <artifactId>linkeddatahub</artifactId>
-    <version>5.5.4</version>
+    <version>5.6.0</version>
     <packaging>${packaging.type}</packaging>
 
     <name>AtomGraph LinkedDataHub</name>
@@ -46,7 +46,7 @@
         <url>https://github.com/AtomGraph/LinkedDataHub</url>
         <connection>scm:git:git://github.com/AtomGraph/LinkedDataHub.git</connection>
         <developerConnection>scm:git:git@github.com:AtomGraph/LinkedDataHub.git</developerConnection>
-        <tag>linkeddatahub-5.5.4</tag>
+        <tag>linkeddatahub-5.6.0</tag>
     </scm>
 
     <repositories>
@@ -93,6 +93,19 @@
             <groupId>org.glassfish.jersey.connectors</groupId>
             <artifactId>jersey-apache-connector</artifactId>
             <version>3.1.11</version>
+            <exclusions>
+                <!-- exclude commons-logging (via httpclient) - jcl-over-slf4j from Jena provides the JCL API. Otherwise duplicate org.apache.commons.logging classes on the classpath -->
+                <exclusion>
+                    <groupId>commons-logging</groupId>
+                    <artifactId>commons-logging</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <!-- pin to the version jena-base 6.1.0 declares; nearest-wins would otherwise downgrade it to 1.18.0 via jersey-apache-connector -->
+            <groupId>commons-codec</groupId>
+            <artifactId>commons-codec</artifactId>
+            <version>1.22.0</version>
         </dependency>
         <dependency>
             <groupId>org.glassfish.jersey.media</groupId>
@@ -112,7 +125,7 @@
         <dependency>
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
-            <version>31.1-jre</version>
+            <version>33.6.0-jre</version>
         </dependency>
         <dependency>
             <groupId>com.atomgraph.etl.csv</groupId>
@@ -146,14 +159,7 @@
         <dependency>
             <groupId>${project.groupId}</groupId>
             <artifactId>twirl</artifactId>
-            <version>1.1.0</version>
-            <exclusions>
-                <!-- exclude slf4j-reload4j 1.7.x binding; replaced below with 2.0.x matching slf4j-api from Jena -->
-                <exclusion>
-                    <groupId>org.slf4j</groupId>
-                    <artifactId>slf4j-reload4j</artifactId>
-                </exclusion>
-            </exclusions>
+            <version>2.0.0</version>
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
@@ -163,13 +169,13 @@
         <dependency>
             <groupId>${project.groupId}</groupId>
             <artifactId>client</artifactId>
-            <version>4.3.0</version>
+            <version>5.0.2</version>
             <classifier>classes</classifier>
         </dependency>
         <dependency>
             <groupId>${project.groupId}</groupId>
             <artifactId>client</artifactId>
-            <version>4.3.0</version>
+            <version>5.0.2</version>
             <type>war</type>
         </dependency>
         <dependency>
@@ -185,24 +191,24 @@
         <dependency>
             <groupId>org.jsoup</groupId>
             <artifactId>jsoup</artifactId>
-            <version>1.22.1</version>
+            <version>1.22.2</version>
         </dependency>
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter</artifactId>
-            <version>5.11.4</version>
+            <version>6.1.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-core</artifactId>
-            <version>5.12.0</version>
+            <version>5.18.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-junit-jupiter</artifactId>
-            <version>5.12.0</version>
+            <version>5.18.0</version>
             <scope>test</scope>
         </dependency>
     </dependencies>