# liquibase.secureParsing user questions

**URL:** <https://forum.liquibase.org/t/liquibase-secureparsing-user-questions/6973>\
**Category:** Uncategorized\
**Tags:** spring-boot, secureparsing\
**Created:** [June 15, 2022, 1:50pm UTC](https://forum.liquibase.org/t/liquibase-secureparsing-user-questions/6973 "2022-06-15T13:50:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ktaggart](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.liquibase.org/ktaggart/32/596_2.png) [@ktaggart](https://forum.liquibase.org/u/ktaggart)\
**Post date:** [June 15, 2022, 1:50pm UTC](https://forum.liquibase.org/t/liquibase-secureparsing-user-questions/6973/1 "2022-06-15T13:50:32Z")

</div>

Adding these here – submitted by users to a closed github issue [Failed to read schema document 'dbchangelog-3.8.xsd', because 'file' access is not allowed due to restriction set by the accessExternalSchema property · Issue #2654 · liquibase/liquibase · GitHub](https://github.com/liquibase/liquibase/issues/2654)

Is there a way to disable liquibase.secureParsing programmatically? (Java)

How do you set liquibase.secureParsing via spring boot project?

Thanks!

---

<div class="post-metadata">

**Author:** ![tabbyfoo](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.liquibase.org/tabbyfoo/32/748_2.png) [@tabbyfoo](https://forum.liquibase.org/u/tabbyfoo)\
**Post date:** [June 16, 2022, 7:36pm UTC](https://forum.liquibase.org/t/liquibase-secureparsing-user-questions/6973/2 "2022-06-16T19:36:54Z")

</div>

Thanks, @ktaggart - I’ll see if I can find out.

---

<div class="post-metadata">

**Author:** ![Herostrates94](https://avatars.discourse-cdn.com/v4/letter/h/a88e57/32.png) [@Herostrates94](https://forum.liquibase.org/u/Herostrates94)\
**Post date:** [July 26, 2022, 8:04pm UTC](https://forum.liquibase.org/t/liquibase-secureparsing-user-questions/6973/3 "2022-07-26T20:04:57Z")

</div>

Hello, any news on that?

---

<div class="post-metadata">

**Author:** ![ktaggart](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.liquibase.org/ktaggart/32/596_2.png) [@ktaggart](https://forum.liquibase.org/u/ktaggart)\
**Post date:** [July 26, 2022, 8:52pm UTC](https://forum.liquibase.org/t/liquibase-secureparsing-user-questions/6973/4 "2022-07-26T20:52:35Z")

</div>

> <https://github.com/liquibase/liquibase/issues/3072>
>
> \<!--- This environment context section helps us quickly review your PR. 
> …Please take a minute to fill-out this information. --\>
> \## Environment
> 
> \*\*Liquibase Version\*\*: 4.8 and higher
> 
> \*\*Liquibase Integration & Version\*\*: Spring Boot
> 
> \*\*Liquibase Extension(s) & Version\*\*: n/a
> 
> \*\*Database Vendor & Version\*\*: Oracle, H2 
> 
> \*\*Operating System Type & Version\*\*: Arch Linux 2019-04-01
> 
> \*\*Infrastructure Type/Provider\*\*: On premise 
> 
> 
> \## Description
> 
> With 4.8 version external (or local) xsd files are no longer parsed by default (when I'm trying to use it in some .xml changeSet file for liquibase in my project). 
> 
> According to this \[thread \](https://github.com/liquibase/liquibase/issues/2654) we can set this property to make it work:
> liquibase.secureParsing=false
> However, it seems like it is not possible to do right now for Spring Boot applications. Application.properties file does not recognize this property and setting it in liquibase.properties does not help. I'm still getting the following error:
> 
> \`Caused by: org.xml.sax.SAXParseException: schema\_reference: Failed to read schema document 'dbchangelog-simple.xsd', because 'file' access is not allowed due to restriction set by the accessExternalSchema property.\`
> 
> Looks like I'm not the only person with this kind of issue: https://stackoverflow.com/questions/72982540/where-to-put-liquibase-properties-file-when-using-org-springframework-boot/73000353
> 
> I'm unable to update my liquibase to 4.8 and higher due to this issue since I had already used some local xsd files in my previous changeSet files - those are on the production environment now. 
> 
> \## Steps To Reproduce
> 
> Try to use some external custom xsd file (like custom primary key generation) in your changeSet .xml file for your Spring Boot application, e.g.:
> 
> dbchangelog-simple.xsd:
> \`\`\`
> \<?xml version="1.0" encoding="UTF-8"?\>
> 
> \<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
> targetNamespace="http://sth.com/liquibase"
> xmlns="http://sth.com/liquibase"
> elementFormDefault="qualified"\>
> 
> \<xsd:element name="definePK"\>
> \<xsd:complexType\>
> \<xsd:attribute name="catalogName" type="xsd:string"/\>
> \<xsd:attribute name="schemaName" type="xsd:string"/\>
> \<xsd:attribute name="tableName" type="xsd:string" use="required"/\>
> \<xsd:attribute name="columnName" type="xsd:string" default="id"/\>
> \<xsd:attribute name="columnDataType" type="xsd:string" default="BIGINT"/\>
> \<xsd:attribute name="strategy" type="xsd:string" default="sequence"/\>
> \</xsd:complexType\>
> \</xsd:element\>
> 
> \</xsd:schema\>
> \`\`\`
> 
> some changeSet file:
> \`\`\`
> \<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xmlns:cs="http://sth.com/liquibase"
> xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.6.xsd http://sth.com/liquibase /liquibase/ext/sth/dbchangelog-simple.xsd"
> \>
> \`\`\`
> 
> Then try to run the Spring Boot application with a fresh database. It will result in the error I've mentioned above. 
> 
> \## Actual Behavior
> \`Caused by: org.xml.sax.SAXParseException: schema\_reference: Failed to read schema document 'dbchangelog-simple.xsd', because 'file' access is not allowed due to restriction set by the accessExternalSchema property.\`
> 
> \## Expected/Desired Behavior
> I need a way to make local xsd files work in my changeSets files for Spring Boot applications. Preferably with liquibase.secureParsing=false.

It is planned, not sure when we will be able to get to the engineering work on it. Keep monitoring the github issue you submitted. That will be the best place to to keep track of the status on the work. Thanks!

---

<div class="post-metadata">

**Author:** ![truls](https://avatars.discourse-cdn.com/v4/letter/t/5f9b8f/32.png) [@truls](https://forum.liquibase.org/u/truls)\
**Post date:** [November 23, 2022, 12:51pm UTC](https://forum.liquibase.org/t/liquibase-secureparsing-user-questions/6973/5 "2022-11-23T12:51:20Z")

</div>

We are using some Liquibase changes that we have written ourselves and this has been working fine with 3.x while including our own XSD in the changelog XML

After upgrading to 4.17 our Unit tests are no longer working because I can’t find a way to set `liquibase.secureParsing` during the initialization in the unit tests.

What I have tried before creating the Liquibase instance

- Using `System.setProperty("liquibase.secureParsing", "false")`
- Using `System.setProperty("LIQUIBASE_SECURE_PARSING", "false"); `
- Adding an argLine to the Maven surefire plugin with `-Dliquibase.secureParsing=false`
- registering a custom `ConfigurationValueProvider` with the `LiquibaseConfiguration` (obtained through `Scope.getCurrentScope().getSingleton()`) - but the `getProvidedValue()` is never called. I tried with a precedence of 1000 and 1 neither made a difference.

Any ideas how I can get this to work from within a JUnit test that manually creates a Liquibase instance using `new Liquibase(....)`?

---

<div class="post-metadata">

**Author:** ![truls](https://avatars.discourse-cdn.com/v4/letter/t/5f9b8f/32.png) [@truls](https://forum.liquibase.org/u/truls)\
**Post date:** [November 24, 2022, 6:24am UTC](https://forum.liquibase.org/t/liquibase-secureparsing-user-questions/6973/6 "2022-11-24T06:24:38Z")

</div>

Not sure what went wrong the first time, but using `<argLine>-Dliquibase.secureParsing=false</argLine>` for the Surefire plugin in the Maven POM did work.

However, it seems Liquibase does not resolved the include XSD. But I will create a new post for that.