You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@santuario.apache.org by co...@apache.org on 2026/04/13 14:13:36 UTC
(santuario-xml-security-java) 01/01: Refactoring reference resolving
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch coheigea/reference-resolving-refactor
in repository https://gitbox.apache.org/repos/asf/santuario-xml-security-java.git
commit c60bf63c0bd3e72dd0f4c04b4706674d7f8e3c18
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Mon Apr 13 15:13:12 2026 +0100
Refactoring reference resolving
---
.../stax/impl/resourceResolvers/ResolverFilesystem.java | 7 ++++++-
.../xml/security/utils/resolver/ResourceResolverContext.java | 4 ++--
.../resolver/implementations/ResolverLocalFilesystem.java | 10 +++++++---
3 files changed, 15 insertions(+), 6 deletions(-)
diff --git a/src/main/java/org/apache/xml/security/stax/impl/resourceResolvers/ResolverFilesystem.java b/src/main/java/org/apache/xml/security/stax/impl/resourceResolvers/ResolverFilesystem.java
index 039d7e07..6a85e483 100644
--- a/src/main/java/org/apache/xml/security/stax/impl/resourceResolvers/ResolverFilesystem.java
+++ b/src/main/java/org/apache/xml/security/stax/impl/resourceResolvers/ResolverFilesystem.java
@@ -25,6 +25,7 @@ import org.apache.xml.security.exceptions.XMLSecurityException;
import org.apache.xml.security.stax.ext.ResourceResolver;
import org.apache.xml.security.stax.ext.ResourceResolverLookup;
import org.apache.xml.security.stax.ext.stax.XMLSecStartElement;
+import org.apache.xml.security.utils.resolver.ResolverUtils;
/**
* Resolver for local filesystem resources. Use the standard java security-manager to
@@ -49,7 +50,11 @@ public class ResolverFilesystem implements ResourceResolver, ResourceResolverLoo
if (uri == null) {
return null;
}
- if (uri.startsWith("file:") || baseURI != null && baseURI.startsWith("file:")) {
+ // At least one of uri or baseURI must start with "file:", and
+ // neither may carry a different explicit scheme (e.g. http:, https:, ftp:).
+ if ((uri.startsWith("file:") || baseURI != null && baseURI.startsWith("file:"))
+ && !ResolverUtils.hasExplicitNonFileScheme(uri)
+ && !ResolverUtils.hasExplicitNonFileScheme(baseURI)) {
return this;
}
return null;
diff --git a/src/main/java/org/apache/xml/security/utils/resolver/ResourceResolverContext.java b/src/main/java/org/apache/xml/security/utils/resolver/ResourceResolverContext.java
index 4c8ef439..5244b8b7 100644
--- a/src/main/java/org/apache/xml/security/utils/resolver/ResourceResolverContext.java
+++ b/src/main/java/org/apache/xml/security/utils/resolver/ResourceResolverContext.java
@@ -62,11 +62,11 @@ public class ResourceResolverContext {
return true;
}
if (uriToResolve != null) {
- if (uriToResolve.startsWith("file:") || uriToResolve.startsWith("http:")) {
+ if (uriToResolve.startsWith("file:") || ResolverUtils.hasExplicitNonFileScheme(uriToResolve)) {
return false;
}
if (!uriToResolve.isEmpty() && uriToResolve.charAt(0) != '#' &&
- baseUri != null && (baseUri.startsWith("file:") || baseUri.startsWith("http:"))) {
+ baseUri != null && (baseUri.startsWith("file:") || ResolverUtils.hasExplicitNonFileScheme(baseUri))) {
return false;
}
}
diff --git a/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java b/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java
index f59c2983..1e6c9f81 100644
--- a/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java
+++ b/src/main/java/org/apache/xml/security/utils/resolver/implementations/ResolverLocalFilesystem.java
@@ -29,6 +29,7 @@ import org.apache.xml.security.signature.XMLSignatureFileInput;
import org.apache.xml.security.utils.resolver.ResourceResolverContext;
import org.apache.xml.security.utils.resolver.ResourceResolverException;
import org.apache.xml.security.utils.resolver.ResourceResolverSpi;
+import org.apache.xml.security.utils.resolver.ResolverUtils;
/**
* A simple ResourceResolver for requests into the local filesystem.
@@ -64,15 +65,18 @@ public class ResolverLocalFilesystem extends ResourceResolverSpi {
return false;
}
- if (context.uriToResolve.isEmpty() || context.uriToResolve.charAt(0) == '#' ||
- context.uriToResolve.startsWith("http:")) {
+ if (context.uriToResolve.isEmpty() || context.uriToResolve.charAt(0) == '#') {
return false;
}
try {
LOG.log(Level.DEBUG, "I was asked whether I can resolve {0}", context.uriToResolve);
- if (context.uriToResolve.startsWith("file:") || context.baseUri.startsWith("file:")) {
+ // At least one of uriToResolve or baseUri must start with "file:", and
+ // neither may carry a different explicit scheme (e.g. http:, https:, ftp:).
+ if ((context.uriToResolve.startsWith("file:") || context.baseUri.startsWith("file:"))
+ && !ResolverUtils.hasExplicitNonFileScheme(context.uriToResolve)
+ && !ResolverUtils.hasExplicitNonFileScheme(context.baseUri)) {
LOG.log(Level.DEBUG, "I state that I can resolve {0}", context.uriToResolve);
return true;
}