(cxf) 05/34: Wire the STSClient through to URIResolver (#3106)

[co...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git

commit 98dbc6d8f449ef09707d78c804fb9f5901424670
Author: Colm O hEigeartaigh <co...@users.noreply.github.com>
AuthorDate: Tue May 12 11:11:29 2026 +0100

    Wire the STSClient through to URIResolver (#3106)
    
    * Switch to use constant time secret comparison
    
    * Use URIResolver allowlist for protocols in the STSClient
    
    (cherry picked from commit 8c17167614943249b2c1940b905ede2e3bb4ce5f)
    (cherry picked from commit 2dadd0d5af6d142616935c662c46b3e21767a44e)
    
    # Conflicts:
    #       rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractTokenService.java
---
 .../oauth2/services/AbstractTokenService.java      |  5 +++++
 .../cxf/ws/security/trust/AbstractSTSClient.java   |  6 +++++-
 .../ws/security/trust/AbstractSTSClientTest.java   | 23 ++++++++++++++++++++++
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractTokenService.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractTokenService.java
index fb05cabbbc8..e170f5e7a24 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractTokenService.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/services/AbstractTokenService.java
@@ -141,8 +141,13 @@ public class AbstractTokenService extends AbstractOAuthService {
         if (clientSecretVerifier != null) {
             return clientSecretVerifier.validateClientSecret(client, providedClientSecret);
         }
+<<<<<<< HEAD
         return client.getClientSecret() != null && providedClientSecret != null
             && MessageDigest.isEqual(client.getClientSecret().getBytes(StandardCharsets.UTF_8),
+=======
+        return client.getClientSecret() != null && providedClientSecret != null 
+            && MessageDigest.isEqual(client.getClientSecret().getBytes(StandardCharsets.UTF_8), 
+>>>>>>> 2dadd0d5af (Wire the STSClient through to URIResolver (#3106))
                                      providedClientSecret.getBytes(StandardCharsets.UTF_8));
     }
     protected boolean isValidPublicClient(Client client, String clientId) {
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java
index 4d12c753ee6..f44f1a113f5 100755
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java
@@ -79,6 +79,7 @@ import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
 import org.apache.cxf.message.Attachment;
 import org.apache.cxf.message.Message;
 import org.apache.cxf.phase.PhaseInterceptorChain;
+import org.apache.cxf.resource.URIResolver;
 import org.apache.cxf.rt.security.claims.ClaimCollection;
 import org.apache.cxf.rt.security.utils.SecurityUtils;
 import org.apache.cxf.service.Service;
@@ -638,7 +639,10 @@ public abstract class AbstractSTSClient implements Configurable, InterceptorProv
         dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
 
         DocumentBuilder documentBuilder = dbf.newDocumentBuilder();
-        Document document = documentBuilder.parse(schemaLocation);
+        Document document;
+        try (URIResolver resolver = new URIResolver(schemaLocation)) {
+            document = documentBuilder.parse(resolver.getInputStream());
+        }
         return document.getDocumentElement();
     }
 
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AbstractSTSClientTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AbstractSTSClientTest.java
index e91232220d3..61887908bb4 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AbstractSTSClientTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AbstractSTSClientTest.java
@@ -33,6 +33,7 @@ import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertSame;
 import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
 
 public class AbstractSTSClientTest {
 
@@ -78,6 +79,18 @@ public class AbstractSTSClientTest {
         assertEquals(0, client.getDownloadSchemaInvocations());
     }
 
+    @Test
+    public void testFtpProtocolAttemptedDownload() throws Exception {
+        DownloadingAbstractSTSClient client = new DownloadingAbstractSTSClient(null);
+        try {
+            client.downloadSchemaWithDefaultResolver("ftp://example.org/schema.xsd");
+            fail("Expected an exception for disallowed ftp:// scheme");
+        } catch (Exception ex) {
+            assertTrue(ex.getMessage().contains("ftp"));
+            assertTrue(ex.getMessage().contains("not permitted"));
+        }
+    }
+
     private static final class TestableAbstractSTSClient extends AbstractSTSClient {
         private int downloadSchemaInvocations;
         private String lastDownloadedLocation;
@@ -102,4 +115,14 @@ public class AbstractSTSClientTest {
             return lastDownloadedLocation;
         }
     }
+
+    private static final class DownloadingAbstractSTSClient extends AbstractSTSClient {
+        DownloadingAbstractSTSClient(Bus bus) {
+            super(bus);
+        }
+
+        Element downloadSchemaWithDefaultResolver(String schemaLocation) throws Exception {
+            return super.downloadSchema(schemaLocation);
+        }
+    }
 }