You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2026/07/08 08:41:30 UTC
(cxf) 01/02: Plug URIResolver into AttachmentUtil (#3289)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 7d941d6e8ce1b7c1d9de305156103de685ef62ed
Author: Colm O hEigeartaigh <co...@users.noreply.github.com>
AuthorDate: Tue Jul 7 17:10:16 2026 +0100
Plug URIResolver into AttachmentUtil (#3289)
(cherry picked from commit 50918830ece560c374387230fbcd8791e26582b9)
---
.../main/java/org/apache/cxf/attachment/AttachmentUtil.java | 7 ++++++-
.../apache/cxf/attachment/AttachmentDeserializerTest.java | 12 ++++++++++++
.../java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java | 8 +++++---
3 files changed, 23 insertions(+), 4 deletions(-)
diff --git a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
index b870c447143..c7184b241ea 100644
--- a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
+++ b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
@@ -63,6 +63,7 @@ import org.apache.cxf.io.CachedOutputStream;
import org.apache.cxf.message.Attachment;
import org.apache.cxf.message.Message;
import org.apache.cxf.message.MessageUtils;
+import org.apache.cxf.resource.URIResolver;
public final class AttachmentUtil {
// The default values for {@link AttachmentDataSource} content type in case when
@@ -593,12 +594,16 @@ public final class AttachmentUtil {
final boolean followUrls = Boolean.valueOf(SystemPropertyAction
.getProperty(ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY, "false"));
if (followUrls) {
- return new URLDataSource(new URL(contentId));
+ final URL remoteUrl = new URL(contentId);
+ URIResolver.checkAllowedScheme(remoteUrl);
+ return new URLDataSource(remoteUrl);
} else {
return loadDataSource(contentId, atts);
}
} catch (MalformedURLException e) {
throw new Fault(e);
+ } catch (IOException e) {
+ throw new Fault(e);
}
}
} else {
diff --git a/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java b/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java
index 1d6e2dd756e..857704c7878 100644
--- a/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java
+++ b/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java
@@ -43,6 +43,7 @@ import org.xml.sax.helpers.DefaultHandler;
import jakarta.activation.DataSource;
import jakarta.activation.URLDataSource;
import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.io.CacheSizeExceededException;
import org.apache.cxf.message.Attachment;
import org.apache.cxf.message.Exchange;
@@ -942,4 +943,15 @@ public class AttachmentDeserializerTest {
System.clearProperty(AttachmentUtil.ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY);
}
}
+
+ @Test
+ public void testCXF8706followUrlRejectsDisallowedScheme() {
+ System.setProperty(AttachmentUtil.ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY, "true");
+ try {
+ assertThrows(Fault.class, () -> AttachmentUtil
+ .getAttachmentDataSource("cid:gopher://image.com/1.gif", Collections.emptyList()));
+ } finally {
+ System.clearProperty(AttachmentUtil.ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY);
+ }
+ }
}
diff --git a/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java b/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java
index fbc7b21cf3b..588b4df82e2 100644
--- a/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java
+++ b/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java
@@ -18,7 +18,6 @@
*/
package org.apache.cxf.aegis.type.mtom;
-import java.net.MalformedURLException;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URL;
@@ -32,6 +31,7 @@ import org.apache.cxf.aegis.util.UID;
import org.apache.cxf.attachment.AttachmentImpl;
import org.apache.cxf.common.util.SystemPropertyAction;
import org.apache.cxf.message.Attachment;
+import org.apache.cxf.resource.URIResolver;
public final class AttachmentUtil {
// The xop:include "href" attribute (https://www.w3.org/TR/xop10/#xop_href) may include
@@ -78,9 +78,11 @@ public final class AttachmentUtil {
if (followUrls) {
// Try loading the URL remotely
try {
- URLDataSource source = new URLDataSource(new URL(id));
+ final URL remoteUrl = new URL(id);
+ URIResolver.checkAllowedScheme(remoteUrl);
+ URLDataSource source = new URLDataSource(remoteUrl);
return new AttachmentImpl(id, new DataHandler(source));
- } catch (MalformedURLException e) {
+ } catch (java.io.IOException e) {
return null;
}
}