This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/wsmex-remote-schema-guard in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 416d3dcc354b54e3c90b7e79f1fc90a3916de056 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Thu Apr 23 10:47:13 2026 +0100 Add a boolean to guard against remove schema download for WS-MEX --- .../cxf/ws/security/trust/AbstractSTSClient.java | 47 ++++++++++++++++------ 1 file changed, 34 insertions(+), 13 deletions(-) diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java index d95294581ea..8d1b68adc6a 100755 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java @@ -208,6 +208,7 @@ public abstract class AbstractSTSClient implements Configurable, InterceptorProv protected List<Feature> features; protected TLSClientParameters tlsClientParameters; + protected boolean allowMexMetadataSchemaLocation; public AbstractSTSClient(Bus b) { bus = b; @@ -249,6 +250,14 @@ public abstract class AbstractSTSClient implements Configurable, InterceptorProv this.tlsClientParameters = tlsClientParameters; } + public boolean isAllowMexMetadataSchemaLocation() { + return allowMexMetadataSchemaLocation; + } + + public void setAllowMexMetadataSchemaLocation(boolean allowMexMetadataSchemaLocation) { + this.allowMexMetadataSchemaLocation = allowMexMetadataSchemaLocation; + } + /** * Sets the WS-P policy that is applied to communications between this client and the remote server * if no value is supplied for {@link #setWsdlLocation(String)}. @@ -542,19 +551,16 @@ public abstract class AbstractSTSClient implements Configurable, InterceptorProv definition = bus.getExtension(WSDLManager.class).getDefinition((Element)s.getAny()); } else if ("http://www.w3.org/2001/XMLSchema".equals(s.getDialect())) { - Element schemaElement = (Element)s.getAny(); - if (schemaElement == null) { - String schemaLocation = s.getLocation(); - LOG.info("XSD schema location: " + schemaLocation); - schemaElement = downloadSchema(schemaLocation); + Element schemaElement = getSchemaElement(s); + if (schemaElement != null) { + QName schemaName = + new QName(schemaElement.getNamespaceURI(), schemaElement.getLocalName()); + WSDLManager wsdlManager = bus.getExtension(WSDLManager.class); + ExtensibilityElement + exElement = wsdlManager.getExtensionRegistry().createExtension(Types.class, schemaName); + ((Schema)exElement).setElement(schemaElement); + schemas.add((Schema)exElement); } - QName schemaName = - new QName(schemaElement.getNamespaceURI(), schemaElement.getLocalName()); - WSDLManager wsdlManager = bus.getExtension(WSDLManager.class); - ExtensibilityElement - exElement = wsdlManager.getExtensionRegistry().createExtension(Types.class, schemaName); - ((Schema)exElement).setElement(schemaElement); - schemas.add((Schema)exElement); } } @@ -614,7 +620,22 @@ public abstract class AbstractSTSClient implements Configurable, InterceptorProv } } - private Element downloadSchema(String schemaLocation) throws Exception { + protected Element getSchemaElement(MetadataSection s) throws Exception { + Element schemaElement = (Element)s.getAny(); + if (schemaElement == null) { + if (!allowMexMetadataSchemaLocation) { + LOG.info("Loading a schema from WS-MEX MetadataSection Location is disabled by " + + " default. Enable allowMexMetadataSchemaLocation to allow it."); + } else { + String schemaLocation = s.getLocation(); + LOG.info("XSD schema location: " + schemaLocation); + schemaElement = downloadSchema(schemaLocation); + } + } + return schemaElement; + } + + protected Element downloadSchema(String schemaLocation) throws Exception { DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
