This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-xmlschema.git
The following commit(s) were added to refs/heads/master by this push:
new dd06ffb3 Fixup DefaultURIResolver wording
dd06ffb3 is described below
commit dd06ffb32335243742df159119476578ec5a573a
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Fri Sep 25 09:41:37 2026 +0100
Fixup DefaultURIResolver wording
---
SECURITY.md | 7 +++++--
THREAT-MODEL.md | 8 ++++++--
.../org/apache/ws/commons/schema/resolver/DefaultURIResolver.java | 8 +++++---
3 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/SECURITY.md b/SECURITY.md
index f38b309c..de700701 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -36,14 +36,17 @@ findings are triaged are documented in
[THREAT-MODEL.md](./THREAT-MODEL.md).
`XmlSchemaCollection` follows `xs:import` / `xs:include` /
`xs:redefine` schema locations through a `URIResolver`. The bundled
`DefaultURIResolver` restricts the URI schemes it will resolve; refuses a
-location that changes the scheme of a remote base, a `file:` location
+local (`file:` or `jar:`) location from a remote base, a `file:` location
naming a remote host, a `jar:` archive fetched over the network, and a
local location that is not a regular file; refuses remote addresses in
classes that never serve a schema (link-local, which includes cloud
metadata endpoints, multicast, wildcard and IPv6 unique-local; see
`org.apache.ws.commons.schema.remote.checkAddresses`, which is skipped when
a proxy carries the fetch); and bounds each remote fetch in time, bytes and
-redirects. It has no host allowlist:
+redirects. A location may move a remote base between `http` and `https`,
+in either direction, so an `https` schema can import one over plain
+`http`; only a redirect that changes scheme is refused. It has no host
+allowlist:
any routable host, loopback or private address, or readable local file
that a schema location names is fetched. An operator with no remote, or no
local, schema sets can turn that transport off (see README.txt). The
diff --git a/THREAT-MODEL.md b/THREAT-MODEL.md
index f6acfa06..551b4e6d 100644
--- a/THREAT-MODEL.md
+++ b/THREAT-MODEL.md
@@ -154,7 +154,7 @@ A finding is in-model only if it reaches a row marked
**yes**.
| --- | --- | --- | --- |
| B1 | Caller → `XmlSchemaCollection.read(InputSource | Reader | Source |
Document | Element)` | none — caller is trusted | none |
| B2 | `XmlSchemaCollection.read(InputSource, ...)` → hardened JDK
`DocumentBuilder` | none | external DTD/entity resolution disabled
unconditionally; DOCTYPE accepted |
-| B3 | Schema parser → `URIResolver.resolveEntity(namespace, schemaLocation,
baseUri)` | none | bundled `DefaultURIResolver` allowlists the effective scheme
(`http`, `https`, `file`, `jar`, judged through any `jar:` wrapper), and
unconditionally refuses a `file:` location naming a non-local authority or a
`jar:` archive fetched over the network; it also refuses a location that
changes the scheme of a remote base. A remote fetch is refused if the host
resolves to a never-legitimate addres [...]
+| B3 | Schema parser → `URIResolver.resolveEntity(namespace, schemaLocation,
baseUri)` | none | bundled `DefaultURIResolver` allowlists the effective scheme
(`http`, `https`, `file`, `jar`, judged through any `jar:` wrapper), and
unconditionally refuses a `file:` location naming a non-local authority or a
`jar:` archive fetched over the network; it also refuses a local (`file:` or
`jar:`) location from a remote base, but not a move between `http` and `https`
in either direction, so an `h [...]
| B4 | Resolved `InputSource` → `XmlSchemaCollection.read(InputSource, ...)`
(recursive) | none | none |
| B5 | `XmlSchema.write(...)` → JDK `TransformerFactory` (with
`FEATURE_SECURE_PROCESSING=true` and external DTD/stylesheet access disabled
where supported) | none | none |
| B6 | `XmlSchemaCollection` ctor →
`System.getProperty("org.apache.ws.commons.schema.extension_registry")` →
`Class.forName()` | none | trusts system properties to be operator-controlled |
@@ -489,7 +489,11 @@ matching disclaimer.
`InputSource` pointing at it. The JDK then fetches it on parse.
The resolver restricts the *scheme* it will hand back — `http`,
`https`, `file` and `jar`, judged through any `jar:` wrapper — and
- refuses a location that changes the scheme of a remote base. It also
+ refuses a local (`file:` or `jar:`) location from a remote base. A move
+ between `http` and `https` is not refused for a location, in either
+ direction, so an `https` schema may import one over plain `http`; only
+ a redirect that changes scheme is refused (§5a `remote.maxRedirects`).
+ It also
refuses, for every location and whatever the base, a `file:` URL that
names a non-local host — in its authority, or as a path beginning
`//`, which is a UNC path on Windows and so an SMB connection to a
diff --git
a/xmlschema-core/src/main/java/org/apache/ws/commons/schema/resolver/DefaultURIResolver.java
b/xmlschema-core/src/main/java/org/apache/ws/commons/schema/resolver/DefaultURIResolver.java
index 24d60ba4..f9528777 100644
---
a/xmlschema-core/src/main/java/org/apache/ws/commons/schema/resolver/DefaultURIResolver.java
+++
b/xmlschema-core/src/main/java/org/apache/ws/commons/schema/resolver/DefaultURIResolver.java
@@ -51,9 +51,11 @@ import org.xml.sax.InputSource;
* <p>
* This resolver is a convenience for trusted, operator-controlled schema
sets. It restricts the URI
* schemes it will resolve to <code>http</code>, <code>https</code>,
<code>file</code> and
- * <code>jar</code>, and refuses a schema location that changes the scheme of
a remote base URI,
- * names a non-local authority with the <code>file:</code> scheme, or reads a
<code>jar:</code>
- * archive fetched over the network. A deployment with no remote schema sets
can turn network
+ * <code>jar</code>, and refuses a schema location that takes a remote base
URI to a local
+ * (<code>file:</code> or <code>jar:</code>) scheme, names a non-local
authority with the
+ * <code>file:</code> scheme, or reads a <code>jar:</code> archive fetched
over the network. A
+ * location may move a remote base between <code>http</code> and
<code>https</code> in either
+ * direction; only a redirect that changes scheme is refused. A deployment
with no remote schema sets can turn network
* resolution off altogether with the {@link #ALLOW_NETWORK_PROPERTY} system
property, and
* filesystem resolution with {@link #ALLOW_FILE_SYSTEM_PROPERTY}, without
supplying its own
* resolver, and the address classes that only ever appear in an SSRF attempt
are refused before
