This is an automated email from the ASF dual-hosted git repository. robertlazarski pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit 843626de8c64c26ded5272063c51773479ae7014 Author: Robert Lazarski <[email protected]> AuthorDate: Wed Sep 2 10:23:10 2026 -1000 Pin the scheme predicate the AAR and WAR SSRF guards rely on The guards only inspect and block schemes once isAbsolute() calls a location absolute, so widening that predicate reroutes file: and jar: locations to the parent resolver instead of the classloader. Cover the boundary so an XmlSchema upgrade cannot move it silently. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .../apache/axis2/deployment/URIResolverTest.java | 41 ++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/modules/kernel/test/org/apache/axis2/deployment/URIResolverTest.java b/modules/kernel/test/org/apache/axis2/deployment/URIResolverTest.java index e74693dc2c..29bd5c1e87 100644 --- a/modules/kernel/test/org/apache/axis2/deployment/URIResolverTest.java +++ b/modules/kernel/test/org/apache/axis2/deployment/URIResolverTest.java @@ -78,4 +78,45 @@ public class URIResolverTest extends TestCase { assertNull("WAR resolver must block relative path resolving to remote URL", inputSource.getSystemId()); } + + /** + * Pin the scheme predicate the SSRF guards above are built on. + * + * The guards only inspect and block schemes once isAbsolute() says the + * location is absolute, so widening that predicate silently reroutes + * locations to the parent resolver. XmlSchema 2.3.3 made + * DefaultURIResolver.isAbsolute private and replaced it with a + * URI.isAbsolute() test, under which file: and jar: locations become + * absolute; these resolvers therefore declare the original predicate + * themselves. Anything that widens it must revisit the guards first. + */ + public void testOnlyHttpHttpsAndUrnAreAbsolute() { + ExposedWarResolver resolver = new ExposedWarResolver(); + + assertTrue("http must be absolute", + resolver.absolute("http://www.test.org/test.xsd";)); + assertTrue("https must be absolute", + resolver.absolute("https://www.test.org/test.xsd";)); + assertTrue("urn must be absolute", + resolver.absolute("urn:test:schema")); + + assertFalse("file: must stay relative, so it is read as a resource" + + " rather than handed to the parent resolver", + resolver.absolute("file:/tmp/test.xsd")); + assertFalse("jar: must stay relative", + resolver.absolute("jar:file:/tmp/app.jar!/test.xsd")); + assertFalse("a plain relative path must stay relative", + resolver.absolute("test.xsd")); + } + + /** Exposes the protected predicate to this package. */ + private static class ExposedWarResolver extends WarFileBasedURIResolver { + ExposedWarResolver() { + super(null); + } + + boolean absolute(String uri) { + return isAbsolute(uri); + } + } }
