pjfanning opened a new pull request, #103:
URL: https://github.com/apache/poi-xmlbeans/pull/103

   ## Problem
   
   `StscState.shouldDownloadURI` gates resolution of `<xsd:import>` / 
`<xsd:include>` / `<xsd:redefine>` `schemaLocation`s. With network downloads 
disabled (the default), remote `http(s)://` locations are correctly refused — 
but any `file:` URI was accepted regardless of the gate and **without 
inspecting the authority**:
   
   ```java
   return equalsIgnoreCase(uri.getScheme(), "file");   // host never checked
   ```
   
   An accepted URL reaches `StscImporter.downloadDocument` → `new 
URL(absoluteURL)` → `loader.parse(url, …)` and is opened. So when an 
application compiles an **untrusted XSD** with default options, a Windows UNC 
location like `file://attacker.example.com/share/evil.xsd` in an import passes 
the gate and triggers an outbound SMB connection to the attacker's host (SSRF 
with attacker-controlled host **and** protocol, capable of leaking NTLM 
credentials) — even though the operator has network downloads disabled. A 
`file:///etc/...` location similarly reaches the local filesystem.
   
   ## Fix
   
   Accept a `file:` URI only when it has no remote authority (`null`, empty, or 
`localhost`). Legitimate local-file includes carry no authority and keep 
working; a UNC / remote-host `file:` URI is now refused like any other blocked 
download. The `jar:`/`zip:` recursion just above funnels back through this same 
check for its embedded URI, so it is covered too.
   
   This does not change the behavior when a caller has opted into downloads 
(via `setCompileDownloadUrls`, an `EntityResolver`, or 
`-Dxmlbean.downloadurls=true`), where `_doingDownloads` short-circuits to 
`true` before this check.
   
   ## Testing
   
   - `./gradlew compileJava` clean
   - `./gradlew test --tests compile.scomp.checkin.CompilationTests --tests 
compile.scomp.som.checkin.PartialSOMCheckinTest` passes (exercise schema 
import/include resolution)
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to