You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@santuario.apache.org by "Michal Bystrianin (JIRA)" <ji...@apache.org> on 2011/05/29 21:44:47 UTC
[jira] [Created] (SANTUARIO-277) URI references using HTTPS
protocol are not properly handled by the
XSECURIResolverGenericWin32::resolveURI method.
URI references using HTTPS protocol are not properly handled by the XSECURIResolverGenericWin32::resolveURI method.
-------------------------------------------------------------------------------------------------------------------
Key: SANTUARIO-277
URL: https://issues.apache.org/jira/browse/SANTUARIO-277
Project: Santuario
Issue Type: Bug
Components: C++
Affects Versions: C++ 1.6.0, C++ 1.6.1
Environment: MS Windows
Reporter: Michal Bystrianin
Assignee: Scott Cantor
HTTPS protocol used in URI reference isn't recognized as valid URI scheme. Note: this bug exists also in XSECURIResolverGenericUnix class.
Simple possible solution: declare new pattern for this scheme
static const XMLCh gHttpsScheme[] = {
chLatin_h,
chLatin_t,
chLatin_t,
chLatin_p,
chLatin_s,
chNull
};
and replace two lines at end of the "resolveURI" method by code as below:
// Is the scheme a HTTP or HTTPS?
if (!XMLString::compareIString(xmluri->getScheme(), gHttpScheme) ||
!XMLString::compareIString(xmluri->getScheme(), gHttpsScheme)) {
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SANTUARIO-277) URI references using HTTPS
protocol are not properly handled by the
XSECURIResolverGenericWin32::resolveURI method.
Posted by "Scott Cantor (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SANTUARIO-277?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13043197#comment-13043197 ]
Scott Cantor commented on SANTUARIO-277:
----------------------------------------
I took a look, and this code is actually sitting on top of, in an amazingly poor choice, a one-off HTTP client inside the Xerces "input stream" abstraction. So your patch will not work, it would require actual TLS support in the xml-security library itself. That is, umm, not gonna happen. ;-)
The solution at this point would be to plug in the Xerces URI input support directly (and https support will not be available in most Xerces builds, but it can be done via libcurl now). That shouldn't be horrendously difficult, but I don't know that I'll have time for that until later this year.
If you have the need, and the time, I can point you at the steps involved to do a patch.
> URI references using HTTPS protocol are not properly handled by the XSECURIResolverGenericWin32::resolveURI method.
> -------------------------------------------------------------------------------------------------------------------
>
> Key: SANTUARIO-277
> URL: https://issues.apache.org/jira/browse/SANTUARIO-277
> Project: Santuario
> Issue Type: Bug
> Components: C++
> Affects Versions: C++ 1.6.0, C++ 1.6.1
> Environment: MS Windows
> Reporter: Michal Bystrianin
> Assignee: Scott Cantor
>
> HTTPS protocol used in URI reference isn't recognized as valid URI scheme. Note: this bug exists also in XSECURIResolverGenericUnix class.
> Simple possible solution: declare new pattern for this scheme
> static const XMLCh gHttpsScheme[] = {
> chLatin_h,
> chLatin_t,
> chLatin_t,
> chLatin_p,
> chLatin_s,
> chNull
> };
> and replace two lines at end of the "resolveURI" method by code as below:
> // Is the scheme a HTTP or HTTPS?
> if (!XMLString::compareIString(xmluri->getScheme(), gHttpScheme) ||
> !XMLString::compareIString(xmluri->getScheme(), gHttpsScheme)) {
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SANTUARIO-277) URI references using HTTPS
protocol are not properly handled by the
XSECURIResolverGenericWin32::resolveURI method.
Posted by "Scott Cantor (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SANTUARIO-277?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13041215#comment-13041215 ]
Scott Cantor commented on SANTUARIO-277:
----------------------------------------
I don't use (and therefore don't support) any of the code you're working with here, but if this code is running on top of Xerces as a resolver, nothing done here will guarantee https URLs resolve. It will just move the failure. I'm ok with that, since it's not anything I care about, but I wanted to check.
> URI references using HTTPS protocol are not properly handled by the XSECURIResolverGenericWin32::resolveURI method.
> -------------------------------------------------------------------------------------------------------------------
>
> Key: SANTUARIO-277
> URL: https://issues.apache.org/jira/browse/SANTUARIO-277
> Project: Santuario
> Issue Type: Bug
> Components: C++
> Affects Versions: C++ 1.6.0, C++ 1.6.1
> Environment: MS Windows
> Reporter: Michal Bystrianin
> Assignee: Scott Cantor
>
> HTTPS protocol used in URI reference isn't recognized as valid URI scheme. Note: this bug exists also in XSECURIResolverGenericUnix class.
> Simple possible solution: declare new pattern for this scheme
> static const XMLCh gHttpsScheme[] = {
> chLatin_h,
> chLatin_t,
> chLatin_t,
> chLatin_p,
> chLatin_s,
> chNull
> };
> and replace two lines at end of the "resolveURI" method by code as below:
> // Is the scheme a HTTP or HTTPS?
> if (!XMLString::compareIString(xmluri->getScheme(), gHttpScheme) ||
> !XMLString::compareIString(xmluri->getScheme(), gHttpsScheme)) {
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira