You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-commits@axis.apache.org by ro...@apache.org on 2026/08/06 13:38:14 UTC
(axis-axis2-java-core) 08/17: Harden five anonymous-reachable surfaces from a private security report
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit 8c783edfdbcd5490a0eb2bedbc3c6a797239b767
Merge: 173bad1882 cfbaf6a648
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Tue Aug 4 08:27:21 2026 -1000
Harden five anonymous-reachable surfaces from a private security report
Reported privately via security@apache.org on 2026-07-30 against
54de37f455. All five reproduce; four are fixed here, one (F3) is
hardened with an opt-in rather than treated as a vulnerability.
F1 CWE-918 WS-Addressing ReplyTo/FaultTo drive a server-initiated connection
to a caller-chosen address. Screened in AddressingInHandler, at the
inbound trust boundary, rather than in the transport sender, which
also carries legitimate client calls. Link-local, wildcard and
multicast refused always; loopback and private ranges behind
blockPrivateNetworkResponseEndpoints.
F2 CWE-79 The Host reached an inline script unescaped in the Swagger UI page.
URI.create did not neutralise it. Host validated, output encoded for
the script context, inline block nonced under a CSP.
F3 CWE-644 servers[].url followed the request Host. Added openapi.serverBaseUrl
to pin it; the request-derived default still follows the Host, as it
does in comparable OpenAPI implementations.
F4 CWE-770 The multipart and form-urlencoded builders read the transport stream
directly, so the container's post limit never applied. Both bounded,
configurable per service. Multipart temp files are now deleted
rather than accumulating.
F5 CWE-862 The .xsd/.wsdl file routes, HTTPWorker's named-WSDL route and the
whole OpenAPI/MCP generator ignored exposeServiceMetadata.
CVEs to be requested after release, per the process followed for
CVE-2026-66713.
.../handlers/addressing/AddressingInHandler.java | 23 ++
.../addressing/ResponseEndpointPolicy.java | 291 +++++++++++++++++++++
.../ResponseEndpointPolicyHandlerTest.java | 146 +++++++++++
.../addressing/ResponseEndpointPolicyTest.java | 213 +++++++++++++++
modules/kernel/conf/axis2.xml | 44 ++++
.../apache/axis2/builder/BoundedInputStream.java | 90 +++++++
.../axis2/builder/MultipartFormDataBuilder.java | 63 ++++-
.../axis2/builder/MultipartTempFileTracker.java | 93 +++++++
.../apache/axis2/builder/RequestSizeLimits.java | 99 +++++++
.../axis2/builder/XFormURLEncodedBuilder.java | 9 +-
.../org/apache/axis2/engine/AxisConfiguration.java | 4 +
.../builder/MultipartFormDataBuilderTest.java | 274 +++++++++++++++++++
.../axis2/builder/RequestSizeLimitsTest.java | 130 +++++++++
.../apache/axis2/openapi/OpenApiConfiguration.java | 13 +
.../apache/axis2/openapi/OpenApiSpecGenerator.java | 61 ++++-
.../org/apache/axis2/openapi/RequestUrlPolicy.java | 112 ++++++++
.../org/apache/axis2/openapi/SwaggerUIHandler.java | 118 ++++++++-
.../apache/axis2/openapi/RequestUrlPolicyTest.java | 103 ++++++++
.../apache/axis2/openapi/SwaggerUIHandlerTest.java | 57 ++++
.../apache/axis2/transport/http/HTTPWorker.java | 10 +
.../apache/axis2/transport/http/ListingAgent.java | 8 +
modules/webapp/conf/axis2.xml | 44 ++++
22 files changed, 1979 insertions(+), 26 deletions(-)