This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/WSS-733 in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit 70d714ba6968101351c1fbe8f740f2165e89a3ef Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Mon Oct 12 10:36:52 2026 +0100 [WSS-733] Fall back to URL/classpath lookup when the file system probe is denied --- .../main/java/org/apache/wss4j/common/util/Loader.java | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/ws-security-common/src/main/java/org/apache/wss4j/common/util/Loader.java b/ws-security-common/src/main/java/org/apache/wss4j/common/util/Loader.java index 3245c1f09..811846753 100644 --- a/ws-security-common/src/main/java/org/apache/wss4j/common/util/Loader.java +++ b/ws-security-common/src/main/java/org/apache/wss4j/common/util/Loader.java @@ -88,7 +88,7 @@ public final class Loader { } catch (InvalidPathException ex) { //NOPMD // skip - not a valid file system path } - if (path != null && Files.exists(path)) { + if (path != null && isExistingFile(path)) { try { return Files.newInputStream(path); } catch (Exception e) { @@ -130,6 +130,22 @@ public final class Loader { return is; } + /** + * Return true if <code>path</code> names an existing file. A caller that is not + * permitted to read the path (e.g. under a SecurityManager without the relevant + * FilePermission) is treated as if the file does not exist, so that resolution falls + * through to the URL and classpath lookups rather than failing outright. No privilege + * is asserted on the caller's behalf. + */ + private static boolean isExistingFile(Path path) { + try { + return Files.exists(path); + } catch (SecurityException ex) { + LOG.debug("Not permitted to check the file system for [{}]", path, ex); + return false; + } + } + /** * Return the scheme that prevents <code>url</code> from being opened, or null if the * URL only uses allowed schemes. For a nested-URL scheme such as "jar"
