REXML::ParseException: Malformed XML — No root element when calling update on Group object

[hiboma]

Summary

When using ruby-jss with rexml 3.4.4 or 3.4.3, I encountered a REXML::ParseException when attempting to call save on a Group object.

The error message indicates that the XML being parsed is malformed due to the absence of a root element. This appears to be related to changes in how REXML validates XML documents.

Environment

• Ruby version: 3.4.6
• ruby-jss: 4.2.3
• rexml versions tested:
  • 3.4.4 ❌ (fails)
  • 3.4.3 ❌ (fails)
  • 3.4.2 ✅ (works as expected)
• OS: macOS

Expected Behavior

ComputerGroup#save should successfully update the group with added members.

Actual Behavior

The method call fails with a REXML::ParseException indicating "Malformed XML: No root element".

Steps to Reproduce

test.rb

#!/usr/bin/env ruby

require 'ruby-jss'

params = {
  host: 'server.example.com',
  client_id: ENV['CLIENT_ID'],
  client_secret: ENV['CLIENT_SECRET'],
}

Jamf.cnx.connect(**params)

id = 131 # example group ID

computer_group = Jamf::ComputerGroup.fetch(id)
computer_group.add_member `hostname`.strip
computer_group.save # 🔥 This line throws the exception

Gemfile

source 'https://rubygems.org'
gem 'ruby-jss'
gem 'rexml', '<version>' # Change version to test different behaviors

Error Stack Trace

/path/to/gems/rexml-3.4.4/lib/rexml/parsers/baseparser.rb:271:in 'REXML::Parsers::BaseParser#pull_event': Malformed XML: No root element (REXML::ParseException)
Line: 1
Position: 54
Last 80 unconsumed characters:

	from /path/to/gems/rexml-3.4.4/lib/rexml/parsers/baseparser.rb:249:in 'REXML::Parsers::BaseParser#pull'
	from /path/to/gems/rexml-3.4.4/lib/rexml/parsers/treeparser.rb:21:in 'REXML::Parsers::TreeParser#parse'
	from /path/to/gems/rexml-3.4.4/lib/rexml/document.rb:468:in 'REXML::Document#build'
	from /path/to/gems/rexml-3.4.4/lib/rexml/document.rb:105:in 'REXML::Document#initialize'
	from /path/to/gems/ruby-jss-4.2.3/lib/jamf/api/classic/base_classes/group.rb:509:in 'Class#new'
	from /path/to/gems/ruby-jss-4.2.3/lib/jamf/api/classic/base_classes/group.rb:509:in 'Jamf::Group#rest_xml'
	from /path/to/gems/ruby-jss-4.2.3/lib/jamf/api/classic/api_objects/updatable.rb:97:in 'Jamf::Updatable#update_in_jamf'
	from /path/to/gems/ruby-jss-4.2.3/lib/jamf/api/classic/base_classes/api_object.rb:1340:in 'Jamf::APIObject#update'
	from /path/to/gems/ruby-jss-4.2.3/lib/jamf/api/classic/base_classes/group.rb:274:in 'Jamf::Group#update'
	from /path/to/gems/ruby-jss-4.2.3/lib/jamf/api/classic/base_classes/group.rb:288:in 'Jamf::Group#save'
	from main.rb:20:in '<main>'

Problematic Code

The issue appears to be in lib/jamf/api/classic/base_classes/group.rb:509:

def rest_xml
  doc = REXML::Document.new Jamf::Connection::XML_HEADER # This line causes the exception
  group = doc.add_element self.class::RSRC_OBJECT_KEY.to_s
  # ...
end

Root Cause Analysis

This exception appears to be caused by recent changes in REXML.

It seems that the exception started occurring after the change introduced in Reject no root element XML as an invalid XML by naitoh · Pull Request #291 · ruby/rexml, which rejects XML documents without a root element as invalid.

The XML_HEADER content may need to be adjusted to ensure it contains a valid root element before being passed to REXML::Document.new.

Workaround

Currently, the only workaround is to downgrade to rexml 3.4.2 which doesn't enforce this validation.
I'm happy to assist with testing any potential fixes. Please let me know if you need any additional information.

[glenfarclas17]

Thanks for the beautifully crafted bug report!

I'm at JNUC this week, but will look at this as soon as possible, it probably affects other classes as well.

Cheers,
-Chris

[hiboma]

After trying various approaches, I found that applying the following patch resolves the exception and allows the code to execute successfully

diff --git a/lib/jamf/api/classic/base_classes/group.rb b/lib/jamf/api/classic/base_classes/group.rb
index 7b1bfd5..b43e372 100644
--- a/lib/jamf/api/classic/base_classes/group.rb
+++ b/lib/jamf/api/classic/base_classes/group.rb
@@ -506,7 +506,8 @@ module Jamf
     # the xml formated data for adding or updating this in the JSS,
     #
     def rest_xml
-      doc = REXML::Document.new Jamf::Connection::XML_HEADER
+      doc = REXML::Document.new
+      doc << REXML::XMLDecl.new("1.0", "UTF-8", "no")
       group = doc.add_element self.class::RSRC_OBJECT_KEY.to_s
       group.add_element('name').text = @name
       group.add_element('is_smart').text = @is_smart

Generated XML

<?xml version='1.0' encoding='UTF-8' standalone='no'?><computer_group><name>***</name><is_smart>false</is_smart><computers><computer><id>1255</id></computer><computer><id>1549</id></computer><computer><id>1549</id></computer></computers><site><name>****</name></site></computer_group>

Tested revision

$ git show --format='%H' --no-patch
e5c6ff07e92156bc21eb49445578c806a9c46eef

Merge branch 'dev' of gitlab.pixar.com:macback/ruby-jss into dev · PixarAnimationStudios/ruby-jss@e5c6ff0

[glenfarclas17]

Oh Fun!

I found a different solution today and was going to upload it for more testing tomorrow (in the 43-ish plces it appears in ruby-jss):

first I added an empty root element to Jamf::Connection::XML_HEADER

XML_HEADER = '<?xml version="1.0" encoding="UTF-8" standalone="no"?><root/>'.freeze

then changed all occurances of this pattern:

      doc = REXML::Document.new Jamf::Connection::XML_HEADER  # No longer allowed without a root element
      pkg = doc.add_element 'package'  # previously this would add the root element

to this

      doc = REXML::Document.new Jamf::Connection::XML_HEADER  # this now has a root element
      doc.root.name = 'package'  # just change its name
      pkg = doc.root # and use it

Implementing either fix will have to happen in all those locations.

I'll get some more testing done tomorrow and upload some changes so you can test also

Thanks again!
-Chris

[glenfarclas17]

Sorry for the delay, as soon as I got home from JNUC, another high-priority project took all my time for a week.

I just uploaded the changes as v4.2.4b1 - you should be able to get it from rubygems.org with

gem install ruby-jss -v 4.2.4b1 --pre

My testing so far looks good. The changes affect all Classic API objects. The changes are all in commit 80e3749.

Feel free to test more.

A quick way to test is in IRB. After connecting to a Jamf Pro server, you can do:

Jamf::ComputerGroup.fetch(:random).ppx

This fetches a random object from a class (ComputerGroup in this case, but you can use any Classic API object) and the ppx method just pretty-prints the XML result of the rest_xml method to stdout.

43:> Jamf::ComputerGroup.fetch(:random).ppx

<?xml version='1.0' encoding='UTF-8' standalone='no'?>
<computer_group>
  <name>Some Static Group Name</name>
  <is_smart>false</is_smart>
  <computers>
    <computer>
      <id>3166</id>
    </computer>
    <computer>
      <id>8617</id>
    </computer>
    <computer>
      <id>5524</id>
    </computer>
  </computers>
  <site>
    <name>NONE</name>
  </site>
</computer_group>
  => nil

Let me know if you find any problems!

I'll try to release this in the next few days.

Cheers,
-Chris

[glenfarclas17]

HI there - 4.2.4 has been out for a few weeks now (and I'm getting ready to release 5.0.0)

I'm going to close this as fixed in that version, but if you still have problems, please let me know and I'll reopen it!

Cheers,
-Chris