You are viewing a plain text version of this content. The canonical link for it is here.
Posted to c-commits@axis.apache.org by ro...@apache.org on 2026/06/01 20:30:29 UTC
(axis-axis2-c-core) branch master updated (241dc4c40 -> b99abf5b1)
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
from 241dc4c40 Fix download links: add missing /core/ in path
new 029fb1089 Add security threat model and AGENTS.md for Glasswing scan
new c6bb51aec Address Gemini review findings for Glasswing threat model
new 5292b2bad Correct http_header.c sprintf assessment: not a buffer overflow
new 3be922f31 Add safety comment to http_header.c sprintf usage
new d97a7accd Rewrite AGENTS.md to prioritize HTTP/2 and JSON scan areas
new 3773ff223 Remove samples/ paths from JSON scan guidance
new 8e4d5f5ec Address Gemini review: add HTTP/2 receiver, util/, MIME paths
new 88e14844d Fix incorrect path for http_transport_utils.c
new b99abf5b1 Fix Java-isms and incorrect LOC claim
The 9 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
AGENTS.md | 167 +++++++++++++++++++++
SECURITY.md | 211 +++++++++++++++++++++++++++
src/core/transport/http/common/http_header.c | 4 +
3 files changed, 382 insertions(+)
create mode 100644 AGENTS.md
create mode 100644 SECURITY.md
(axis-axis2-c-core) 08/09: Fix incorrect path for http_transport_utils.c
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit 88e14844d7a73869782a44073fe23b7ded29cd51
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Mon Jun 1 10:13:12 2026 -1000
Fix incorrect path for http_transport_utils.c
File is in util/ subdirectory, not common/.
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
AGENTS.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/AGENTS.md b/AGENTS.md
index c498e61dd..76cae6d1f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -68,7 +68,7 @@ Key locations: JSON message builders, HTTP/2 stream buffer management,
attachment handlers, HTTP chunked transfer decoding.
Key files:
-- `src/core/transport/http/common/http_transport_utils.c` (MIME processing)
+- `src/core/transport/http/util/http_transport_utils.c` (MIME processing)
- `axiom/src/attachments/` (attachment data structure management)
### 4. Use-After-Free in Connection Handling
(axis-axis2-c-core) 05/09: Rewrite AGENTS.md to prioritize HTTP/2 and JSON scan areas
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit d97a7accd7b0d33e8af6f2d9f873d5f4f36ee2a0
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Mon Jun 1 09:54:22 2026 -1000
Rewrite AGENTS.md to prioritize HTTP/2 and JSON scan areas
Modern deployments use HTTP/2 with pure JSON, not HTTP/1.1 with SOAP.
Reorder scan priorities: HTTP/2 transport handler, JSON processing,
and memory safety in stream management are now items 1-4. Legacy
HTTP/1.1 parsing and XML parser hardening moved to items 6-7 as
secondary concerns. Added missing HTTP/2 key files: h2 handler,
sender, receiver, and JSON-RPC native dispatch.
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
AGENTS.md | 146 ++++++++++++++++++++++++++++++++++++++------------------------
1 file changed, 89 insertions(+), 57 deletions(-)
diff --git a/AGENTS.md b/AGENTS.md
index c6071bf53..8bd94965a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7,7 +7,7 @@ See [SECURITY.md](SECURITY.md) for the full threat model, including:
- Project description (C-based SOAP/REST/JSON web services engine)
- Roles and trust levels
- Security boundaries: what is and is not a security issue
-- Attack surface by component (XML parsers, JSON, HTTP headers, memory safety)
+- Attack surface by component (HTTP/2, JSON, XML parsers, memory safety)
- Memory safety profile (buffer overflows, use-after-free, format strings)
- Build-time hardening flags
- Fuzz testing and OSS-Fuzz integration
@@ -17,92 +17,124 @@ For detailed deployment hardening, see [docs/SECURITY.md](docs/SECURITY.md).
## High-Priority Scan Areas
-Because this is a C codebase, **memory safety vulnerabilities take
-priority** alongside the logical vulnerabilities shared with Axis2/Java.
+Modern Axis2/C deployments use **HTTP/2 with pure JSON** — not HTTP/1.1
+with SOAP/XML. The scan should weight accordingly: HTTP/2 transport,
+JSON processing, and the mod_axis2 Apache handler are the primary
+attack surface. Legacy HTTP/1.1 and XML paths are secondary.
-### 1. Buffer Safety in HTTP Parsing
+### 1. HTTP/2 Transport (primary production path)
-Scan for `sprintf()` usage throughout the HTTP transport code and verify
-that buffer allocations are correctly sized. The known `sprintf()` in
-`http_header.c` uses a heap buffer sized from measured input lengths,
-but other call sites should be audited for similar correctness.
+The HTTP/2 transport handles all modern traffic via nghttp2 stream
+multiplexing. Scan for memory safety in stream lifecycle management,
+header processing (HPACK), request/response buffer handling, and
+connection teardown under error conditions. The Apache httpd handler
+is the production entry point.
Key files:
-- `src/core/transport/http/common/http_header.c`
-- `src/core/transport/http/common/http_status_line.c`
-- `src/core/transport/http/common/http_request_line.c`
-
-### 2. Format String Vulnerabilities
-
-Verify that no user-controlled input reaches `printf`-family functions
-or `AXIS2_LOG_*` macros as the format argument. The pattern
-`AXIS2_LOG_INFO(env->log, AXIS2_LOG_SI, user_input)` is exploitable;
-it must be `AXIS2_LOG_INFO(env->log, AXIS2_LOG_SI, "%s", user_input)`.
-
-Key locations: All logging calls in transport, receiver, and dispatcher
-code that handle client-supplied data (URIs, headers, SOAP fault strings).
+- `src/core/transport/h2/server/apache2/axis2_http2_handler.c` (production entry point)
+- `src/core/transport/h2/sender/axis2_h2_transport_sender.c` (outbound HTTP/2)
+- `src/core/receivers/axis2_http2_msg_recv.c` (HTTP/2 message receiver)
+- `src/core/transport/http/util/axis2_h2_transport_utils.c` (HTTP/2 utilities)
-### 3. XML Parser Security (libxml2 path)
-
-When built with `--enable-libxml2`, verify that the custom external
-entity loader (`axis2_secure_external_entity_loader`) cannot be
-bypassed. The Guththila parser (default) is inherently XXE-safe.
-
-Key files:
-- `axiom/src/parser/libxml2/libxml2_reader_wrapper.c`
-- `guththila/src/guththila_xml_parser.c`
-
-### 4. JSON Processing (both paths)
+### 2. JSON Processing (both HTTP/2 and HTTP/1.1 paths)
Two JSON processing paths exist with different risk profiles:
-- **HTTP/2 path:** Direct `json_tokener_parse()` via json-c. Depth
- limit (64) and size limit (10MB) enforced. Fuzz-tested.
-- **HTTP/1.1 path:** JSON-to-AXIOM conversion in `axis2_json_reader.c`
- (25K LOC). More complex, more attack surface. Fuzz-tested.
+- **HTTP/2 path (primary):** Direct `json_tokener_parse()` via json-c
+ with depth limit (64) and size limit (10MB). Native JSON objects
+ bypass AXIOM/XML entirely. Fuzz-tested.
+- **HTTP/1.1 path (legacy):** JSON-to-AXIOM conversion in
+ `axis2_json_reader.c` (25K LOC). More complex, more attack surface.
+ Fuzz-tested.
Scan both paths for integer overflow in size calculations (CVE-2020-12762
-pattern) and stack exhaustion from deep nesting.
+pattern) and stack exhaustion from deep nesting. The HTTP/2 JSON-RPC
+message receiver dispatches methods to service operations — scan for
+method name injection and type confusion.
Key files:
- `src/core/transport/http/util/axis2_h2_transport_utils.c` (HTTP/2 JSON)
- `src/core/transport/http/util/axis2_json_reader.c` (HTTP/1.1 JSON)
+- `samples/user_guide/bigdata-h2-service/src/axis2_json_rpc_msg_recv_native.c` (HTTP/2 JSON-RPC dispatch)
+- `samples/user_guide/bigdata-h2-service/src/axis2_json_msg_builder.c` (JSON message builder)
+- `samples/user_guide/bigdata-h2-service/src/axis2_json_streaming_msg_formatter.c` (streaming JSON output)
-### 5. Integer Overflow in Memory Allocation
+### 3. Integer Overflow in Memory Allocation
C code is vulnerable to integer wrap-around in buffer size calculations.
Scan for patterns like `malloc(count * element_size)` where `count` or
`element_size` come from untrusted input without overflow checks.
+Prioritize the HTTP/2 transport and JSON processing paths.
-Key locations: Message builders, attachment handlers, JSON/XML parsers,
-HTTP chunked transfer decoding.
+Key locations: JSON message builders, HTTP/2 stream buffer management,
+attachment handlers, HTTP chunked transfer decoding.
-### 6. Use-After-Free in Connection Handling
+### 4. Use-After-Free in Connection Handling
-HTTP connection lifecycle management involves complex cleanup ordering,
-creating risks for use-after-free vulnerabilities. Scan for any use of
-connection or request-related objects after they have been freed,
-especially in error handling paths. A known memory leak exists in this
-area, indicating complex memory management where UAFs may also be
-present. Prioritize finding exploitable UAFs over simple memory leaks.
+HTTP/2 stream multiplexing and HTTP/1.1 connection lifecycle management
+involve complex cleanup ordering, creating risks for use-after-free
+vulnerabilities. Scan for any use of connection, stream, or
+request-related objects after they have been freed, especially in error
+handling paths and connection teardown. Prioritize finding exploitable
+UAFs over simple memory leaks.
Key files:
+- `src/core/transport/h2/server/apache2/axis2_http2_handler.c`
+- `src/core/transport/h2/sender/axis2_h2_transport_sender.c`
- `src/core/transport/http/sender/http_client.c`
- `src/core/transport/http/common/simple_http_svr_conn.c`
+### 5. Format String Vulnerabilities
+
+Verify that no user-controlled input reaches `printf`-family functions
+or `AXIS2_LOG_*` macros as the format argument. The pattern
+`AXIS2_LOG_INFO(env->log, AXIS2_LOG_SI, user_input)` is exploitable;
+it must be `AXIS2_LOG_INFO(env->log, AXIS2_LOG_SI, "%s", user_input)`.
+
+Key locations: All logging calls in transport, receiver, and dispatcher
+code that handle client-supplied data (URIs, headers, JSON-RPC method
+names, SOAP fault strings).
+
+### 6. XML Parser Security (libxml2 path, secondary)
+
+When built with `--enable-libxml2`, verify that the custom external
+entity loader (`axis2_secure_external_entity_loader`) cannot be
+bypassed. The Guththila parser (default) is inherently XXE-safe.
+Note: modern deployments primarily use HTTP/2 with JSON, making this
+a secondary concern.
+
+Key files:
+- `axiom/src/parser/libxml2/libxml2_reader_wrapper.c`
+- `guththila/src/guththila_xml_parser.c`
+
+### 7. Buffer Safety in HTTP/1.1 Parsing (secondary)
+
+Scan for `sprintf()` usage throughout the HTTP/1.1 transport code and
+verify that buffer allocations are correctly sized. The `sprintf()` in
+`http_header.c` uses a heap buffer sized from measured input lengths.
+
+Key files:
+- `src/core/transport/http/common/http_header.c`
+- `src/core/transport/http/common/http_status_line.c`
+- `src/core/transport/http/common/http_request_line.c`
+
## Project Structure
```
-src/core/ Core engine: transport, deployment, engine, receivers,
- dispatchers, context, util
-axiom/ AXIOM object model + XML parser wrappers (Guththila, libxml2)
-guththila/ Guththila XML parser (default, XXE-safe)
-neethi/ WS-Policy framework
-util/ Utility library (allocator, string, hash, linked list)
-fuzz/ OSS-Fuzz targets (5 fuzzers)
-test/ gtest-based unit tests + security tests
-samples/ Sample services (camera-control, financial benchmarks)
-src/modules/ Apache httpd modules (mod_addr, mod_log)
+src/core/
+ transport/h2/ HTTP/2 transport: sender, Apache httpd handler, tests
+ transport/http/ HTTP/1.1 transport: server, sender, utilities, JSON
+ receivers/ Message receivers (HTTP/2 and SOAP)
+ engine/ Message processing engine
+ deployment/ Service deployment
+ dispatchers/ Request routing
+axiom/ AXIOM object model + XML parser wrappers (Guththila, libxml2)
+guththila/ Guththila XML parser (default, XXE-safe)
+neethi/ WS-Policy framework
+util/ Utility library (allocator, string, hash, linked list)
+fuzz/ OSS-Fuzz targets (5 fuzzers)
+test/ gtest-based unit tests + security tests
+samples/ Sample services including HTTP/2 BigData and financial benchmarks
```
## Testing and Fuzzing
(axis-axis2-c-core) 02/09: Address Gemini review findings for Glasswing threat model
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit c6bb51aec46e25f4e292943660e16cd816f2dbcf
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Mon Jun 1 09:36:15 2026 -1000
Address Gemini review findings for Glasswing threat model
- Clarify schema complexity DoS risk in WSDL/XSD parsing
- Distinguish use-after-free from memory leak in scan guidance
- Use generic stress test description instead of sample app terminology
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
AGENTS.md | 15 +++++++++------
SECURITY.md | 2 +-
2 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/AGENTS.md b/AGENTS.md
index 7c7698f61..615696fa4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -79,10 +79,12 @@ HTTP chunked transfer decoding.
### 6. Use-After-Free in Connection Handling
-HTTP connection lifecycle management involves complex cleanup ordering.
-A known 15-byte leak per connection exists in test scenarios
-(documented in `HTTP_CONNECTION_MAP_MEMORY_LEAK.md`). Scan for
-use-after-free in connection teardown, especially under error conditions.
+HTTP connection lifecycle management involves complex cleanup ordering,
+creating risks for use-after-free vulnerabilities. Scan for any use of
+connection or request-related objects after they have been freed,
+especially in error handling paths. A known memory leak exists in this
+area, indicating complex memory management where UAFs may also be
+present. Prioritize finding exploitable UAFs over simple memory leaks.
Key files:
- `src/core/transport/http/sender/http_client.c`
@@ -110,8 +112,9 @@ src/modules/ Apache httpd modules (mod_addr, mod_log)
- **Security tests:** `test/security/` (XXE, buffer safety, JSON)
- **Penetration tests:** `test/security/h2_penetration_test.sh` (HTTP/2 JSON)
- **ASAN:** Build with `--enable-asan` for AddressSanitizer coverage
-- **Stress tests:** 500-asset covariance, 10M Monte Carlo simulations,
- 100 concurrent requests — zero ASAN errors
+- **Stress tests:** Framework stability validated under high concurrency
+ (100+ requests), large payloads, and long-running connections — zero
+ ASAN errors
## Reporting
diff --git a/SECURITY.md b/SECURITY.md
index 4a2a9fd2f..9b01e629a 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -120,7 +120,7 @@ Response serialization → transport out
| **JSON-to-AXIOM reader** (HTTP/1.1) | Deep nesting; memory exhaustion during conversion | Fuzz-tested (`fuzz_json_reader`); size limits inherited from transport |
| **HTTP request/status line parsing** | Oversized lines; malformed methods/URIs | Status line limit (512 bytes); request line parsed by delimiter |
| **MTOM/XOP attachments** | Large attachment DoS; temp file exhaustion | Chunked transfer max (100MB default) |
-| **WSDL/XSD parsing** | XXE in imported schemas; recursive schema DoS | Uses chosen XML parser with its hardening; no explicit schema complexity limits |
+| **WSDL/XSD parsing** | XXE in imported schemas; recursive schema DoS | Uses chosen XML parser with its hardening for XXE. **No explicit limits on schema complexity or recursion depth during validation — potential DoS risk.** |
| **HTTP client transport** (outbound) | TLS downgrade; weak ciphers; hostname bypass | TLS 1.2+ enforced; SSLv2/SSLv3/TLS 1.0-1.1 disabled; AEAD ciphers only; hostname validation enabled |
| **mod_axis2** (Apache httpd) | Shared memory corruption; configuration injection | apr_pool allocation; apr_global_mutex for thread safety |
(axis-axis2-c-core) 07/09: Address Gemini review: add HTTP/2 receiver, util/, MIME paths
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit 8e4d5f5ec4064ff3086249874e2ba6a9ff17b591
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Mon Jun 1 10:02:26 2026 -1000
Address Gemini review: add HTTP/2 receiver, util/, MIME paths
- Add axis2_http2_msg_recv.c to JSON scan targets (fills gap from
samples/ path removal)
- Add core util/ library (allocator, string, hash) as scan area —
foundational code where vulnerabilities have widespread impact
- Add MIME/attachment file paths to integer overflow section
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
AGENTS.md | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
diff --git a/AGENTS.md b/AGENTS.md
index 0d07a2d19..c498e61dd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -55,6 +55,7 @@ method name injection and type confusion.
Key files:
- `src/core/transport/http/util/axis2_h2_transport_utils.c` (HTTP/2 JSON)
- `src/core/transport/http/util/axis2_json_reader.c` (HTTP/1.1 JSON)
+- `src/core/receivers/axis2_http2_msg_recv.c` (HTTP/2 JSON-RPC dispatch)
### 3. Integer Overflow in Memory Allocation
@@ -66,6 +67,10 @@ Prioritize the HTTP/2 transport and JSON processing paths.
Key locations: JSON message builders, HTTP/2 stream buffer management,
attachment handlers, HTTP chunked transfer decoding.
+Key files:
+- `src/core/transport/http/common/http_transport_utils.c` (MIME processing)
+- `axiom/src/attachments/` (attachment data structure management)
+
### 4. Use-After-Free in Connection Handling
HTTP/2 stream multiplexing and HTTP/1.1 connection lifecycle management
@@ -92,7 +97,19 @@ Key locations: All logging calls in transport, receiver, and dispatcher
code that handle client-supplied data (URIs, headers, JSON-RPC method
names, SOAP fault strings).
-### 6. XML Parser Security (libxml2 path, secondary)
+### 6. Memory Safety in Core Utilities
+
+The `util/` library provides fundamental data structures and memory
+management used throughout the entire project. A vulnerability here
+would have widespread impact. Scan for memory corruption, integer
+overflows, and logic errors in these foundational components.
+
+Key files:
+- `util/src/allocator.c` (memory allocation wrappers)
+- `util/src/string.c` (string manipulation)
+- `util/src/hash.c` (hash table implementation)
+
+### 7. XML Parser Security (libxml2 path, secondary)
When built with `--enable-libxml2`, verify that the custom external
entity loader (`axis2_secure_external_entity_loader`) cannot be
@@ -104,7 +121,7 @@ Key files:
- `axiom/src/parser/libxml2/libxml2_reader_wrapper.c`
- `guththila/src/guththila_xml_parser.c`
-### 7. Buffer Safety in HTTP/1.1 Parsing (secondary)
+### 8. Buffer Safety in HTTP/1.1 Parsing (secondary)
Scan for `sprintf()` usage throughout the HTTP/1.1 transport code and
verify that buffer allocations are correctly sized. The `sprintf()` in
(axis-axis2-c-core) 01/09: Add security threat model and AGENTS.md for Glasswing scan
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit 029fb1089805388df590d83d53e3a62626158d91
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Mon Jun 1 09:29:15 2026 -1000
Add security threat model and AGENTS.md for Glasswing scan
ASF Security Team's Glasswing program requires a security/threat model
and AGENTS.md before running AI-driven vulnerability scans. Documents
roles, trust levels, security boundaries, C-specific memory safety
concerns (buffer overflows, format strings, integer overflows),
attack surface, OSS-Fuzz integration, and dependency versions.
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
AGENTS.md | 118 +++++++++++++++++++++++++++++++++
SECURITY.md | 211 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 329 insertions(+)
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 000000000..7c7698f61
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,118 @@
+# AGENTS.md — Apache Axis2/C
+
+## Security Threat Model
+
+See [SECURITY.md](SECURITY.md) for the full threat model, including:
+
+- Project description (C-based SOAP/REST/JSON web services engine)
+- Roles and trust levels
+- Security boundaries: what is and is not a security issue
+- Attack surface by component (XML parsers, JSON, HTTP headers, memory safety)
+- Memory safety profile (buffer overflows, use-after-free, format strings)
+- Build-time hardening flags
+- Fuzz testing and OSS-Fuzz integration
+- Dependency version requirements
+
+For detailed deployment hardening, see [docs/SECURITY.md](docs/SECURITY.md).
+
+## High-Priority Scan Areas
+
+Because this is a C codebase, **memory safety vulnerabilities take
+priority** alongside the logical vulnerabilities shared with Axis2/Java.
+
+### 1. HTTP Header Buffer Overflow (known issue)
+
+`http_header.c:150` uses unbounded `sprintf()` to format HTTP headers.
+Maliciously long header names or values can overflow the stack buffer.
+Scan for all `sprintf()` usage throughout the codebase and verify
+adequate bounds checking.
+
+Key files:
+- `src/core/transport/http/common/http_header.c`
+- `src/core/transport/http/common/http_status_line.c`
+- `src/core/transport/http/common/http_request_line.c`
+
+### 2. Format String Vulnerabilities
+
+Verify that no user-controlled input reaches `printf`-family functions
+or `AXIS2_LOG_*` macros as the format argument. The pattern
+`AXIS2_LOG_INFO(env->log, AXIS2_LOG_SI, user_input)` is exploitable;
+it must be `AXIS2_LOG_INFO(env->log, AXIS2_LOG_SI, "%s", user_input)`.
+
+Key locations: All logging calls in transport, receiver, and dispatcher
+code that handle client-supplied data (URIs, headers, SOAP fault strings).
+
+### 3. XML Parser Security (libxml2 path)
+
+When built with `--enable-libxml2`, verify that the custom external
+entity loader (`axis2_secure_external_entity_loader`) cannot be
+bypassed. The Guththila parser (default) is inherently XXE-safe.
+
+Key files:
+- `axiom/src/parser/libxml2/libxml2_reader_wrapper.c`
+- `guththila/src/guththila_xml_parser.c`
+
+### 4. JSON Processing (both paths)
+
+Two JSON processing paths exist with different risk profiles:
+
+- **HTTP/2 path:** Direct `json_tokener_parse()` via json-c. Depth
+ limit (64) and size limit (10MB) enforced. Fuzz-tested.
+- **HTTP/1.1 path:** JSON-to-AXIOM conversion in `axis2_json_reader.c`
+ (25K LOC). More complex, more attack surface. Fuzz-tested.
+
+Scan both paths for integer overflow in size calculations (CVE-2020-12762
+pattern) and stack exhaustion from deep nesting.
+
+Key files:
+- `src/core/transport/http/util/axis2_h2_transport_utils.c` (HTTP/2 JSON)
+- `src/core/transport/http/util/axis2_json_reader.c` (HTTP/1.1 JSON)
+
+### 5. Integer Overflow in Memory Allocation
+
+C code is vulnerable to integer wrap-around in buffer size calculations.
+Scan for patterns like `malloc(count * element_size)` where `count` or
+`element_size` come from untrusted input without overflow checks.
+
+Key locations: Message builders, attachment handlers, JSON/XML parsers,
+HTTP chunked transfer decoding.
+
+### 6. Use-After-Free in Connection Handling
+
+HTTP connection lifecycle management involves complex cleanup ordering.
+A known 15-byte leak per connection exists in test scenarios
+(documented in `HTTP_CONNECTION_MAP_MEMORY_LEAK.md`). Scan for
+use-after-free in connection teardown, especially under error conditions.
+
+Key files:
+- `src/core/transport/http/sender/http_client.c`
+- `src/core/transport/http/common/simple_http_svr_conn.c`
+
+## Project Structure
+
+```
+src/core/ Core engine: transport, deployment, engine, receivers,
+ dispatchers, context, util
+axiom/ AXIOM object model + XML parser wrappers (Guththila, libxml2)
+guththila/ Guththila XML parser (default, XXE-safe)
+neethi/ WS-Policy framework
+util/ Utility library (allocator, string, hash, linked list)
+fuzz/ OSS-Fuzz targets (5 fuzzers)
+test/ gtest-based unit tests + security tests
+samples/ Sample services (camera-control, financial benchmarks)
+src/modules/ Apache httpd modules (mod_addr, mod_log)
+```
+
+## Testing and Fuzzing
+
+- **OSS-Fuzz:** Active integration with 5 libFuzzer targets (XML, JSON x2,
+ HTTP headers, URLs). See `docs/OSS-FUZZ.md`.
+- **Security tests:** `test/security/` (XXE, buffer safety, JSON)
+- **Penetration tests:** `test/security/h2_penetration_test.sh` (HTTP/2 JSON)
+- **ASAN:** Build with `--enable-asan` for AddressSanitizer coverage
+- **Stress tests:** 500-asset covariance, 10M Monte Carlo simulations,
+ 100 concurrent requests — zero ASAN errors
+
+## Reporting
+
+Security vulnerabilities: **security@apache.org**
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..4a2a9fd2f
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,211 @@
+# Security Threat Model — Apache Axis2/C
+
+## Project Description
+
+Apache Axis2/C is a SOAP and REST web services engine implemented in C.
+It provides HTTP/1.1 and HTTP/2 transports, dual XML parsers (Guththila
+and libxml2), native JSON processing (via json-c), MTOM/XOP attachment
+handling, and hot-deployment of services. It runs as a standalone HTTP
+server or as an Apache httpd module (`mod_axis2`).
+
+Being a C implementation, memory safety vulnerabilities (buffer overflows,
+use-after-free, format strings, integer overflows) are in scope in
+addition to the logical vulnerabilities shared with Axis2/Java.
+
+For detailed deployment hardening guidance, see
+[docs/SECURITY.md](docs/SECURITY.md).
+
+## Roles and Trust Levels
+
+| Role | Trust Level | Description |
+|------|-------------|-------------|
+| **Server Administrator** | Fully trusted | Configures `axis2.xml`, compiles with chosen parser/transport options, manages TLS certificates, deploys services. |
+| **Service Deployer** | Trusted | Deploys shared libraries (`.so`/`.dll`) into the services directory. Has filesystem write access. |
+| **Authenticated Client** | Partially trusted | Identity verified by transport (TLS client cert), WS-Security (via Rampart/C), or application-level auth. |
+| **Anonymous Client** | Untrusted | Remote caller with no credentials. Can reach any HTTP endpoint. All input is hostile. |
+
+## Security Boundaries
+
+### What IS a security issue
+
+- **Remote Code Execution (RCE)** — buffer overflow, format string, or
+ other memory corruption exploitable by a remote attacker through the
+ Axis2/C framework.
+- **Memory safety violations** — heap/stack buffer overflows,
+ use-after-free, double-free, or null pointer dereferences reachable
+ from untrusted input.
+- **XML External Entity (XXE) injection** — the XML parser resolves
+ external entities from untrusted input, enabling file read or SSRF.
+ (Guththila is inherently immune; libxml2 requires hardening.)
+- **Server-Side Request Forgery (SSRF)** — the server makes requests to
+ arbitrary hosts due to attacker-controlled URLs in WSDL imports,
+ external entities, or client-side HTTP transport.
+- **Denial of Service via parser abuse** — XML bombs, deeply nested
+ JSON (>64 levels), or payloads exceeding size limits (>10MB) that
+ crash the process or exhaust memory.
+- **Integer overflow** — size calculations in buffer allocation or
+ payload processing that wrap around, leading to undersized buffers
+ and subsequent overflows.
+- **Format string vulnerabilities** — user-controlled data passed as
+ the format argument to `printf`-family functions or logging macros.
+- **Information disclosure** — stack traces, internal paths, or
+ configuration details leaked in SOAP faults or HTTP error responses.
+- **TLS/SSL vulnerabilities** — acceptance of deprecated protocols
+ (SSLv2, SSLv3, TLS 1.0/1.1) or weak cipher suites in the HTTP
+ client transport.
+
+### What is NOT a security issue
+
+- **Vulnerabilities in user-written services.** Input validation,
+ SQL injection, and business logic flaws in deployed service
+ implementations are the service author's responsibility.
+- **Missing authentication.** Axis2/C does not ship built-in
+ authentication. Securing endpoints is the responsibility of
+ Rampart/C, the servlet container (Apache httpd), or a reverse proxy.
+- **Hot-deployment with weak filesystem permissions.** If an attacker
+ can write to the services directory, they can deploy arbitrary shared
+ libraries. This is an OS-level access control issue.
+- **Denial of service at the network level.** SYN floods, slowloris,
+ and connection exhaustion are mitigated by Apache httpd or the
+ network infrastructure, not by Axis2/C.
+- **Vulnerabilities in optional, external modules.** Rampart/C
+ (WS-Security) is a separate project.
+- **The standalone HTTP server in production.** It is intended for
+ development/testing. Production deployments should use `mod_axis2`
+ behind a reverse proxy.
+
+## Architecture and Attack Surface
+
+### Message Processing Pipeline
+
+```
+Remote Client (untrusted input)
+ |
+ v
+Apache httpd (TLS, connection limits, WAF)
+ or standalone axis2_http_server (dev only)
+ |
+ v
+mod_axis2 / HTTP request processor
+ |
+ v
+Content-Type routing:
+ JSON → json-c parser (HTTP/2) or JSON→AXIOM reader (HTTP/1.1)
+ XML → Guththila (default) or libxml2
+ |
+ v
+AXIOM object model
+ |
+ v
+Dispatchers → route to service/operation
+ |
+ v
+Handler phases (Rampart/C security module executes here)
+ |
+ v
+Message Receiver → invoke service function
+ |
+ v
+Response serialization → transport out
+```
+
+### Attack Surface by Component
+
+| Component | Threats | Mitigations |
+|-----------|---------|-------------|
+| **Guththila XML parser** | Malformed XML causing crashes; deep nesting stack exhaustion | Inherently XXE-safe (no entity processing); fuzz-tested via OSS-Fuzz |
+| **libxml2 parser** (optional) | XXE, SSRF, billion laughs, entity expansion | `XML_PARSE_NONET`; custom entity loader blocks all external resolution; depth limit (256); attribute limit (256); namespace limit (64) |
+| **HTTP header parsing** | Buffer overflow via `sprintf()` in `http_header.c:150` | **Known issue** — unbounded `sprintf()` on header name/value concatenation; mitigate with reverse proxy |
+| **JSON parser** (json-c, HTTP/2) | Deep nesting stack exhaustion; integer overflow (CVE-2020-12762 pattern); large payload DoS | Depth limit (64 levels); payload size limit (10MB); fuzz-tested |
+| **JSON-to-AXIOM reader** (HTTP/1.1) | Deep nesting; memory exhaustion during conversion | Fuzz-tested (`fuzz_json_reader`); size limits inherited from transport |
+| **HTTP request/status line parsing** | Oversized lines; malformed methods/URIs | Status line limit (512 bytes); request line parsed by delimiter |
+| **MTOM/XOP attachments** | Large attachment DoS; temp file exhaustion | Chunked transfer max (100MB default) |
+| **WSDL/XSD parsing** | XXE in imported schemas; recursive schema DoS | Uses chosen XML parser with its hardening; no explicit schema complexity limits |
+| **HTTP client transport** (outbound) | TLS downgrade; weak ciphers; hostname bypass | TLS 1.2+ enforced; SSLv2/SSLv3/TLS 1.0-1.1 disabled; AEAD ciphers only; hostname validation enabled |
+| **mod_axis2** (Apache httpd) | Shared memory corruption; configuration injection | apr_pool allocation; apr_global_mutex for thread safety |
+
+### Transports
+
+| Transport | Security Notes |
+|-----------|----------------|
+| HTTP/HTTPS (mod_axis2) | Production transport. TLS handled by Apache httpd. Recommended behind reverse proxy. |
+| HTTP/HTTPS (standalone) | Development only. Single-threaded. No production-grade connection limits. |
+| HTTP/2 (nghttp2) | Stream multiplexing. CVE-2023-44487 (rapid reset) mitigated by nghttp2 version. |
+
+## Memory Safety Profile
+
+As a C codebase, memory safety is a primary concern:
+
+| Category | Risk Level | Notes |
+|----------|-----------|-------|
+| **Buffer overflow** | Medium | `sprintf()` in HTTP header formatting (known); `snprintf()` used elsewhere |
+| **Use-after-free** | Low | Allocator-based memory management (`axutil_allocator_t`); ASAN testing |
+| **Format string** | Low | Risk if user input reaches logging macros without `%s` format; code review addressed (Jan 2026) |
+| **Integer overflow** | Low | Payload size limits prevent wrap-around in allocation; Gemini review findings addressed |
+| **Null dereference** | Low | Defensive null checks throughout; `env` parameter validated at entry points |
+
+### Build-Time Hardening
+
+Production builds should use:
+```
+CFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security"
+LDFLAGS="-pie -Wl,-z,relro,-z,now"
+```
+
+AddressSanitizer is available for development via `--enable-asan`.
+
+## Security Hardening History
+
+### Features Removed (AXIS2C-1708, January 2026)
+
+| Feature | Reason for Removal |
+|---------|-------------------|
+| NTLM authentication | Pass-the-hash vulnerabilities; Microsoft deprecating |
+| TCP transport | No encryption, no authentication, incompatible with HTTP infrastructure |
+| CGI transport | Obsolete deployment model |
+| libcurl HTTP backend | Redundant with native client; MTOM broken; HTTP/2 uses nghttp2 |
+
+### Hardening Applied (January-February 2026)
+
+- TLS 1.0/1.1 completely disabled in client transport
+- Strong cipher suites enforced (AEAD + forward secrecy)
+- JSON payload size limits (10MB) and depth limits (64 levels) added
+- libxml2 entity loader override blocks all external entity resolution
+- OSS-Fuzz integration with 5 fuzz targets (XML, JSON x2, HTTP headers, URLs)
+- Integer overflow and size_t consistency fixes from Gemini code review
+
+## Fuzz Testing and OSS-Fuzz
+
+Axis2/C has an active OSS-Fuzz integration with 5 fuzz targets:
+
+| Target | Coverage |
+|--------|----------|
+| `fuzz_xml_parser` | Guththila AXIOM parsing |
+| `fuzz_json_parser` | json-c direct parsing (HTTP/2 path) |
+| `fuzz_json_reader` | JSON-to-AXIOM conversion (HTTP/1.1 path) |
+| `fuzz_http_header` | HTTP header parsing |
+| `fuzz_url_parser` | URL parsing and SSRF detection |
+
+Additionally, `fuzz_finbench` tests the FinancialBenchmarkService at
+the application level with integer overflow and boundary value inputs.
+
+Local fuzzing validated with 8M+ iterations and zero ASAN errors.
+See [docs/OSS-FUZZ.md](docs/OSS-FUZZ.md) for details.
+
+## Dependency Security
+
+| Dependency | Minimum Version | Key CVEs Tracked |
+|-----------|----------------|------------------|
+| OpenSSL | 1.1.1k+ | CVE-2021-3449, CVE-2021-3450 |
+| libxml2 | 2.9.10+ | CVE-2020-24977, CVE-2019-20388 |
+| json-c | 0.15+ | CVE-2020-12762 (integer overflow) |
+| nghttp2 | 1.50.0+ | CVE-2023-44487 (HTTP/2 rapid reset) |
+| Apache httpd | 2.4.62+ | CVE-2024-40725, CVE-2024-40898 |
+
+Monthly CVE checks run via GitHub Actions (`.github/workflows/cve-check.yml`).
+
+## Reporting Security Issues
+
+Report vulnerabilities to: **security@apache.org**
+
+Follow the [Apache Security Policy](https://www.apache.org/security/).
(axis-axis2-c-core) 04/09: Add safety comment to http_header.c sprintf usage
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit 3be922f31cc538d5d3af6f26fd60d7cef1176c9e
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Mon Jun 1 09:46:53 2026 -1000
Add safety comment to http_header.c sprintf usage
Document why sprintf is safe here (heap buffer sized from measured
input lengths) and note the snprintf consideration if the interface
ever changes.
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
src/core/transport/http/common/http_header.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/core/transport/http/common/http_header.c b/src/core/transport/http/common/http_header.c
index e98bbf33a..1c9410def 100644
--- a/src/core/transport/http/common/http_header.c
+++ b/src/core/transport/http/common/http_header.c
@@ -145,6 +145,10 @@ axis2_http_header_to_external_form(
AXIS2_PARAM_CHECK(env->error, http_header, NULL);
+ /* +8 covers ": " (2) + "\r\n" (2) + null (1) + padding (3).
+ * The buffer is heap-allocated to the measured size, so sprintf is safe
+ * here. Consider snprintf(external_form, len, ...) if this function
+ * ever accepts caller-supplied lengths instead of measured strings. */
len = axutil_strlen(http_header->name) + axutil_strlen(http_header->value) + 8;
external_form = (axis2_char_t *)AXIS2_MALLOC(env->allocator, len);
sprintf(external_form, "%s: %s%s", http_header->name, http_header->value, AXIS2_HTTP_CRLF);
(axis-axis2-c-core) 03/09: Correct http_header.c sprintf assessment: not a buffer overflow
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit 5292b2bad40e39d74861bd3a7939f83ddb7a9046
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Mon Jun 1 09:45:02 2026 -1000
Correct http_header.c sprintf assessment: not a buffer overflow
The sprintf() in axis2_http_header_to_external_form() writes to a heap
buffer allocated to the exact measured size (line 148-149). This is not
an unbounded stack overflow. Downgrade from "known issue" to normal
audit item.
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
AGENTS.md | 10 +++++-----
SECURITY.md | 4 ++--
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/AGENTS.md b/AGENTS.md
index 615696fa4..c6071bf53 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -20,12 +20,12 @@ For detailed deployment hardening, see [docs/SECURITY.md](docs/SECURITY.md).
Because this is a C codebase, **memory safety vulnerabilities take
priority** alongside the logical vulnerabilities shared with Axis2/Java.
-### 1. HTTP Header Buffer Overflow (known issue)
+### 1. Buffer Safety in HTTP Parsing
-`http_header.c:150` uses unbounded `sprintf()` to format HTTP headers.
-Maliciously long header names or values can overflow the stack buffer.
-Scan for all `sprintf()` usage throughout the codebase and verify
-adequate bounds checking.
+Scan for `sprintf()` usage throughout the HTTP transport code and verify
+that buffer allocations are correctly sized. The known `sprintf()` in
+`http_header.c` uses a heap buffer sized from measured input lengths,
+but other call sites should be audited for similar correctness.
Key files:
- `src/core/transport/http/common/http_header.c`
diff --git a/SECURITY.md b/SECURITY.md
index 9b01e629a..19ef146fe 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -115,7 +115,7 @@ Response serialization → transport out
|-----------|---------|-------------|
| **Guththila XML parser** | Malformed XML causing crashes; deep nesting stack exhaustion | Inherently XXE-safe (no entity processing); fuzz-tested via OSS-Fuzz |
| **libxml2 parser** (optional) | XXE, SSRF, billion laughs, entity expansion | `XML_PARSE_NONET`; custom entity loader blocks all external resolution; depth limit (256); attribute limit (256); namespace limit (64) |
-| **HTTP header parsing** | Buffer overflow via `sprintf()` in `http_header.c:150` | **Known issue** — unbounded `sprintf()` on header name/value concatenation; mitigate with reverse proxy |
+| **HTTP header parsing** | Header injection (CRLF); malformed header parsing | `sprintf()` in `http_header.c` writes to a heap buffer sized from measured input lengths; fuzz-tested via OSS-Fuzz |
| **JSON parser** (json-c, HTTP/2) | Deep nesting stack exhaustion; integer overflow (CVE-2020-12762 pattern); large payload DoS | Depth limit (64 levels); payload size limit (10MB); fuzz-tested |
| **JSON-to-AXIOM reader** (HTTP/1.1) | Deep nesting; memory exhaustion during conversion | Fuzz-tested (`fuzz_json_reader`); size limits inherited from transport |
| **HTTP request/status line parsing** | Oversized lines; malformed methods/URIs | Status line limit (512 bytes); request line parsed by delimiter |
@@ -138,7 +138,7 @@ As a C codebase, memory safety is a primary concern:
| Category | Risk Level | Notes |
|----------|-----------|-------|
-| **Buffer overflow** | Medium | `sprintf()` in HTTP header formatting (known); `snprintf()` used elsewhere |
+| **Buffer overflow** | Low | HTTP header formatting uses `sprintf()` with correctly-sized heap allocations; `snprintf()` used elsewhere |
| **Use-after-free** | Low | Allocator-based memory management (`axutil_allocator_t`); ASAN testing |
| **Format string** | Low | Risk if user input reaches logging macros without `%s` format; code review addressed (Jan 2026) |
| **Integer overflow** | Low | Payload size limits prevent wrap-around in allocation; Gemini review findings addressed |
(axis-axis2-c-core) 09/09: Fix Java-isms and incorrect LOC claim
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit b99abf5b1469eb25381dc6e0468fa4f3b3136c25
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Mon Jun 1 10:17:29 2026 -1000
Fix Java-isms and incorrect LOC claim
- Replace "servlet container" with "web server" (httpd is not a
servlet container)
- Remove incorrect 25K LOC claim for axis2_json_reader.c (actual: 719)
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
AGENTS.md | 2 +-
SECURITY.md | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/AGENTS.md b/AGENTS.md
index 76cae6d1f..42ce8a74c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -44,7 +44,7 @@ Two JSON processing paths exist with different risk profiles:
with depth limit (64) and size limit (10MB). Native JSON objects
bypass AXIOM/XML entirely. Fuzz-tested.
- **HTTP/1.1 path (legacy):** JSON-to-AXIOM conversion in
- `axis2_json_reader.c` (25K LOC). More complex, more attack surface.
+ `axis2_json_reader.c`. More complex, more attack surface.
Fuzz-tested.
Scan both paths for integer overflow in size calculations (CVE-2020-12762
diff --git a/SECURITY.md b/SECURITY.md
index 19ef146fe..09327966d 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -61,7 +61,7 @@ For detailed deployment hardening guidance, see
implementations are the service author's responsibility.
- **Missing authentication.** Axis2/C does not ship built-in
authentication. Securing endpoints is the responsibility of
- Rampart/C, the servlet container (Apache httpd), or a reverse proxy.
+ Rampart/C, the web server (Apache httpd), or a reverse proxy.
- **Hot-deployment with weak filesystem permissions.** If an attacker
can write to the services directory, they can deploy arbitrary shared
libraries. This is an OS-level access control issue.
(axis-axis2-c-core) 06/09: Remove samples/ paths from JSON scan guidance
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit 3773ff22389c8a977a65e48de5169098ec6d3b55
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Mon Jun 1 09:59:22 2026 -1000
Remove samples/ paths from JSON scan guidance
Sample code paths mislead the scanner into treating samples/ as
high-priority framework code. The descriptive text is sufficient
to guide the scan toward the relevant vulnerability patterns.
Co-Authored-By: Claude Opus 4.6 (1M context) <no...@anthropic.com>
---
AGENTS.md | 3 ---
1 file changed, 3 deletions(-)
diff --git a/AGENTS.md b/AGENTS.md
index 8bd94965a..0d07a2d19 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -55,9 +55,6 @@ method name injection and type confusion.
Key files:
- `src/core/transport/http/util/axis2_h2_transport_utils.c` (HTTP/2 JSON)
- `src/core/transport/http/util/axis2_json_reader.c` (HTTP/1.1 JSON)
-- `samples/user_guide/bigdata-h2-service/src/axis2_json_rpc_msg_recv_native.c` (HTTP/2 JSON-RPC dispatch)
-- `samples/user_guide/bigdata-h2-service/src/axis2_json_msg_builder.c` (JSON message builder)
-- `samples/user_guide/bigdata-h2-service/src/axis2_json_streaming_msg_formatter.c` (streaming JSON output)
### 3. Integer Overflow in Memory Allocation