You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2026/06/02 09:30:08 UTC
(cxf) branch coheigea/integration-jndi created (now 0b51b29da72)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch coheigea/integration-jndi
in repository https://gitbox.apache.org/repos/asf/cxf.git
at 0b51b29da72 Harden JNDI for integration/jca
This branch includes the following new commits:
new 0b51b29da72 Harden JNDI for integration/jca
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(cxf) 01/01: Harden JNDI for integration/jca
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch coheigea/integration-jndi
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 0b51b29da72e68632f2726524e3cfc213a476409
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Tue Jun 2 10:29:43 2026 +0100
Harden JNDI for integration/jca
---
.../core/resourceadapter/JndiNameValidator.java | 34 +++++++++++++++
.../inbound/DispatchMDBMessageListenerImpl.java | 2 +
.../org/apache/cxf/jca/servant/EJBEndpoint.java | 2 +
.../resourceadapter/JndiNameValidatorTest.java | 48 ++++++++++++++++++++++
4 files changed, 86 insertions(+)
diff --git a/integration/jca/src/main/java/org/apache/cxf/jca/core/resourceadapter/JndiNameValidator.java b/integration/jca/src/main/java/org/apache/cxf/jca/core/resourceadapter/JndiNameValidator.java
new file mode 100644
index 00000000000..ae9a6b7a14e
--- /dev/null
+++ b/integration/jca/src/main/java/org/apache/cxf/jca/core/resourceadapter/JndiNameValidator.java
@@ -0,0 +1,34 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.jca.core.resourceadapter;
+
+/**
+ * Validates JNDI names before lookup to prevent remote URL-based lookups.
+ */
+public final class JndiNameValidator {
+
+ private JndiNameValidator() {
+ }
+
+ public static void validateJndiName(String name) {
+ if (name != null && name.contains("://")) {
+ throw new IllegalArgumentException("JNDI name must not contain a URL: " + name);
+ }
+ }
+}
\ No newline at end of file
diff --git a/integration/jca/src/main/java/org/apache/cxf/jca/inbound/DispatchMDBMessageListenerImpl.java b/integration/jca/src/main/java/org/apache/cxf/jca/inbound/DispatchMDBMessageListenerImpl.java
index 10202b70cf2..63780203144 100644
--- a/integration/jca/src/main/java/org/apache/cxf/jca/inbound/DispatchMDBMessageListenerImpl.java
+++ b/integration/jca/src/main/java/org/apache/cxf/jca/inbound/DispatchMDBMessageListenerImpl.java
@@ -24,6 +24,7 @@ import javax.naming.InitialContext;
import jakarta.ejb.MessageDrivenBean;
import jakarta.ejb.MessageDrivenContext;
+import org.apache.cxf.jca.core.resourceadapter.JndiNameValidator;
/**
* DispatchMDBMessageListenerImpl supports dispatching of calls to a
@@ -50,6 +51,7 @@ public class DispatchMDBMessageListenerImpl
* Looks up the target object by EJB local reference.
*/
public Object lookupTargetObject(String targetJndiName) throws Exception {
+ JndiNameValidator.validateJndiName(targetJndiName);
Object home = new InitialContext().lookup(targetJndiName);
Method method = home.getClass().getMethod("create", new Class[0]);
return method.invoke(home, new Object[0]);
diff --git a/integration/jca/src/main/java/org/apache/cxf/jca/servant/EJBEndpoint.java b/integration/jca/src/main/java/org/apache/cxf/jca/servant/EJBEndpoint.java
index 32cd63ef0df..3e00816ae62 100644
--- a/integration/jca/src/main/java/org/apache/cxf/jca/servant/EJBEndpoint.java
+++ b/integration/jca/src/main/java/org/apache/cxf/jca/servant/EJBEndpoint.java
@@ -38,6 +38,7 @@ import org.apache.cxf.common.util.PackageUtils;
import org.apache.cxf.endpoint.Server;
import org.apache.cxf.frontend.ServerFactoryBean;
import org.apache.cxf.jaxws.JaxWsServerFactoryBean;
+import org.apache.cxf.jca.core.resourceadapter.JndiNameValidator;
import org.apache.cxf.jca.cxf.WorkManagerThreadPool;
import org.apache.cxf.transport.http_jetty.JettyHTTPServerEngine;
import org.apache.cxf.transport.http_jetty.JettyHTTPServerEngineFactory;
@@ -67,6 +68,7 @@ public class EJBEndpoint {
public Server publish() throws Exception {
jndiContext = new InitialContext();
+ JndiNameValidator.validateJndiName(config.getJNDIName());
Object obj = jndiContext.lookup(config.getJNDIName());
ejbHome = (EJBHome) PortableRemoteObject.narrow(obj, EJBHome.class);
diff --git a/integration/jca/src/test/java/org/apache/cxf/jca/core/resourceadapter/JndiNameValidatorTest.java b/integration/jca/src/test/java/org/apache/cxf/jca/core/resourceadapter/JndiNameValidatorTest.java
new file mode 100644
index 00000000000..0a0e32318ef
--- /dev/null
+++ b/integration/jca/src/test/java/org/apache/cxf/jca/core/resourceadapter/JndiNameValidatorTest.java
@@ -0,0 +1,48 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.jca.core.resourceadapter;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+public class JndiNameValidatorTest {
+
+ @Test
+ public void testValidateJndiNamePlainNamesAllowed() {
+ JndiNameValidator.validateJndiName("java:comp/env/ejb/MyBean");
+ JndiNameValidator.validateJndiName("ejb/MyBeanLocal");
+ JndiNameValidator.validateJndiName(null);
+ }
+
+ @Test
+ public void testValidateJndiNameRemoteUrlRejected() {
+ for (String malicious : new String[]{
+ "ldap://attacker.com/exploit",
+ "rmi://attacker.com/exploit",
+ "iiop://attacker.com/exploit"
+ }) {
+ try {
+ JndiNameValidator.validateJndiName(malicious);
+ Assert.fail("Expected IllegalArgumentException for: " + malicious);
+ } catch (IllegalArgumentException e) {
+ Assert.assertTrue(e.getMessage().contains("JNDI name must not contain a URL"));
+ }
+ }
+ }
+}
\ No newline at end of file