From f63afc82538d0d828b5ab758ab91d367cdf9be03 Mon Sep 17 00:00:00 2001
From: Dan Tsekhanskiy <28414793+TsekNet@users.noreply.github.com>
Date: Sat, 15 Mar 2025 11:40:50 -0400
Subject: [PATCH] Ignore comments at the top of XML files (#27176)

Allows comments to be at the top of Fleet XML CSP files (addresses
https://github.com/fleetdm/fleet/issues/26443)

We should validate that this fixes the errors with GitOps pushes, but I
don't know how to do that without pushing this change through to QA.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
---
 changes/26443-xml-comments       | 1 +
 server/fleet/windows_mdm.go      | 3 +++
 server/fleet/windows_mdm_test.go | 2 ++
 3 files changed, 6 insertions(+)
 create mode 100644 changes/26443-xml-comments

diff --git a/changes/26443-xml-comments b/changes/26443-xml-comments
new file mode 100644
index 0000000000..90439da266
--- /dev/null
+++ b/changes/26443-xml-comments
@@ -0,0 +1 @@
+* Allow for any number of comments at the top of XML files for Windows MDM profile CSPs
\ No newline at end of file
diff --git a/server/fleet/windows_mdm.go b/server/fleet/windows_mdm.go
index 98198c4084..adbabff60e 100644
--- a/server/fleet/windows_mdm.go
+++ b/server/fleet/windows_mdm.go
@@ -96,6 +96,9 @@ func (m *MDMWindowsConfigProfile) ValidateUserProvided() error {
 		case xml.ProcInst:
 			return errors.New("The file should include valid XML: processing instructions are not allowed.")
 
+		case xml.Comment:
+			continue
+
 		case xml.StartElement:
 			switch t.Name.Local {
 			case "Replace", "Add":
diff --git a/server/fleet/windows_mdm_test.go b/server/fleet/windows_mdm_test.go
index 0a16717546..2738e703fa 100644
--- a/server/fleet/windows_mdm_test.go
+++ b/server/fleet/windows_mdm_test.go
@@ -411,7 +411,9 @@ func TestValidateUserProvided(t *testing.T) {
 			profile: MDMWindowsConfigProfile{
 				SyncML: []byte(`
 				  <!-- this is a comment -->
+				  <!-- this is another comment -->
 				  <Replace>
+				  <!-- this is a comment inside replace -->
 				    <Target>
 				      <LocURI>Custom/URI</LocURI>
 				    </Target>