This is an automated email from the ASF dual-hosted git repository.

robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git

commit d1672a510e7858a2f25913252d9b1fab24a7c0a0
Author: Robert Lazarski <[email protected]>
AuthorDate: Tue May 19 04:21:34 2026 -1000

    Fix getXMLSchema() resolver: check original loc, not resolved URI
    
    The allowlist approach was blocking resolved file:// URIs that came
    from relative schemaLocation paths (e.g., "wsat.xsd" resolved against
    a file:// base URI produces file:///path/to/wsat.xsd which is absolute).
    Relative paths are safe regardless of what they resolve to — they
    reference co-packaged schemas. Only block absolute schemaLocation
    values in the original loc parameter.
    
    Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
---
 .../description/WSDLToAxisServiceBuilder.java      | 23 +++++++---------------
 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git 
a/modules/kernel/src/org/apache/axis2/description/WSDLToAxisServiceBuilder.java 
b/modules/kernel/src/org/apache/axis2/description/WSDLToAxisServiceBuilder.java
index cc38f14f87..560f4ea544 100644
--- 
a/modules/kernel/src/org/apache/axis2/description/WSDLToAxisServiceBuilder.java
+++ 
b/modules/kernel/src/org/apache/axis2/description/WSDLToAxisServiceBuilder.java
@@ -154,26 +154,17 @@ public abstract class WSDLToAxisServiceBuilder {
                             delegate = new 
org.apache.ws.commons.schema.resolver.DefaultURIResolver();
                     public org.xml.sax.InputSource resolveEntity(
                             String ns, String loc, String base) {
-                        // Allowlist: only permit relative paths resolved
-                        // against the base URI. Block all absolute URIs
-                        // (http, https, ftp, file, jar, etc.) to prevent
-                        // both SSRF and LFI. Co-packaged schemas in .aar
-                        // deployments use relative paths and are safe.
+                        // Block absolute schemaLocation URIs to prevent
+                        // SSRF and LFI. Relative paths (e.g., "wsat.xsd")
+                        // are safe — they resolve against the local base
+                        // URI of the WSDL document.
                         if (loc != null) {
-                            String resolved = loc;
-                            if (base != null) {
-                                try {
-                                    resolved = java.net.URI.create(base)
-                                            .resolve(loc).toString();
-                                } catch (IllegalArgumentException ignored) {
-                                }
-                            }
                             try {
-                                java.net.URI uri = new java.net.URI(resolved);
-                                if (uri.isAbsolute()) {
+                                java.net.URI locUri = new java.net.URI(loc);
+                                if (locUri.isAbsolute()) {
                                     throw new RuntimeException(
                                         "Absolute schemaLocation blocked: "
-                                        + resolved + " (use setCustomResolver"
+                                        + loc + " (use setCustomResolver"
                                         + " to opt in)");
                                 }
                             } catch (java.net.URISyntaxException ignored) {

Reply via email to