This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/main by this push:
new b1b8a9c297a Add a boolean to guard against remove schema download for
WS-MEX (#3054)
b1b8a9c297a is described below
commit b1b8a9c297a9e1e152ee5338622a21e643c92a2e
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Thu Apr 23 15:49:12 2026 +0100
Add a boolean to guard against remove schema download for WS-MEX (#3054)
---
.../cxf/ws/security/trust/AbstractSTSClient.java | 47 ++++++---
.../ws/security/trust/AbstractSTSClientTest.java | 105 +++++++++++++++++++++
2 files changed, 139 insertions(+), 13 deletions(-)
diff --git
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java
index d95294581ea..8d1b68adc6a 100755
---
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java
+++
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java
@@ -208,6 +208,7 @@ public abstract class AbstractSTSClient implements
Configurable, InterceptorProv
protected List<Feature> features;
protected TLSClientParameters tlsClientParameters;
+ protected boolean allowMexMetadataSchemaLocation;
public AbstractSTSClient(Bus b) {
bus = b;
@@ -249,6 +250,14 @@ public abstract class AbstractSTSClient implements
Configurable, InterceptorProv
this.tlsClientParameters = tlsClientParameters;
}
+ public boolean isAllowMexMetadataSchemaLocation() {
+ return allowMexMetadataSchemaLocation;
+ }
+
+ public void setAllowMexMetadataSchemaLocation(boolean
allowMexMetadataSchemaLocation) {
+ this.allowMexMetadataSchemaLocation = allowMexMetadataSchemaLocation;
+ }
+
/**
* Sets the WS-P policy that is applied to communications between this
client and the remote server
* if no value is supplied for {@link #setWsdlLocation(String)}.
@@ -542,19 +551,16 @@ public abstract class AbstractSTSClient implements
Configurable, InterceptorProv
definition =
bus.getExtension(WSDLManager.class).getDefinition((Element)s.getAny());
} else if
("http://www.w3.org/2001/XMLSchema".equals(s.getDialect())) {
- Element schemaElement = (Element)s.getAny();
- if (schemaElement == null) {
- String schemaLocation = s.getLocation();
- LOG.info("XSD schema location: " + schemaLocation);
- schemaElement = downloadSchema(schemaLocation);
+ Element schemaElement = getSchemaElement(s);
+ if (schemaElement != null) {
+ QName schemaName =
+ new QName(schemaElement.getNamespaceURI(),
schemaElement.getLocalName());
+ WSDLManager wsdlManager =
bus.getExtension(WSDLManager.class);
+ ExtensibilityElement
+ exElement =
wsdlManager.getExtensionRegistry().createExtension(Types.class, schemaName);
+ ((Schema)exElement).setElement(schemaElement);
+ schemas.add((Schema)exElement);
}
- QName schemaName =
- new QName(schemaElement.getNamespaceURI(),
schemaElement.getLocalName());
- WSDLManager wsdlManager =
bus.getExtension(WSDLManager.class);
- ExtensibilityElement
- exElement =
wsdlManager.getExtensionRegistry().createExtension(Types.class, schemaName);
- ((Schema)exElement).setElement(schemaElement);
- schemas.add((Schema)exElement);
}
}
@@ -614,7 +620,22 @@ public abstract class AbstractSTSClient implements
Configurable, InterceptorProv
}
}
- private Element downloadSchema(String schemaLocation) throws Exception {
+ protected Element getSchemaElement(MetadataSection s) throws Exception {
+ Element schemaElement = (Element)s.getAny();
+ if (schemaElement == null) {
+ if (!allowMexMetadataSchemaLocation) {
+ LOG.info("Loading a schema from WS-MEX MetadataSection
Location is disabled by "
+ + " default. Enable allowMexMetadataSchemaLocation to
allow it.");
+ } else {
+ String schemaLocation = s.getLocation();
+ LOG.info("XSD schema location: " + schemaLocation);
+ schemaElement = downloadSchema(schemaLocation);
+ }
+ }
+ return schemaElement;
+ }
+
+ protected Element downloadSchema(String schemaLocation) throws Exception {
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
diff --git
a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AbstractSTSClientTest.java
b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AbstractSTSClientTest.java
new file mode 100644
index 00000000000..48f43402dfb
--- /dev/null
+++
b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AbstractSTSClientTest.java
@@ -0,0 +1,105 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.ws.security.trust;
+
+import javax.xml.XMLConstants;
+
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.helpers.DOMUtils;
+import org.apache.cxf.ws.mex.model._2004_09.MetadataSection;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertSame;
+import static org.junit.Assert.assertTrue;
+
+public class AbstractSTSClientTest {
+
+ @Test
+ public void testSchemaLocationDownloadDisabledByDefault() throws Exception
{
+ TestableAbstractSTSClient client = new TestableAbstractSTSClient(null);
+ MetadataSection section = new MetadataSection();
+ section.setDialect(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+ section.setLocation("http://example.org/schema.xsd";);
+
+ assertFalse(client.isAllowMexMetadataSchemaLocation());
+ assertTrue(client.getSchemaElement(section) == null);
+ }
+
+ @Test
+ public void testSchemaLocationDownloadAllowedWhenEnabled() throws
Exception {
+ TestableAbstractSTSClient client = new TestableAbstractSTSClient(null);
+ MetadataSection section = new MetadataSection();
+ section.setDialect(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+ section.setLocation("http://example.org/schema.xsd";);
+
+ client.setAllowMexMetadataSchemaLocation(true);
+
+ Element schemaElement = client.getSchemaElement(section);
+ assertEquals(1, client.getDownloadSchemaInvocations());
+ assertEquals("http://example.org/schema.xsd";,
client.getLastDownloadedLocation());
+ assertEquals(XMLConstants.W3C_XML_SCHEMA_NS_URI,
schemaElement.getNamespaceURI());
+ assertEquals("schema", schemaElement.getLocalName());
+ }
+
+ @Test
+ public void testInlineSchemaElementDoesNotDownload() throws Exception {
+ TestableAbstractSTSClient client = new TestableAbstractSTSClient(null);
+ MetadataSection section = new MetadataSection();
+ section.setDialect(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+
+ Document document = DOMUtils.createDocument();
+ Element inlineSchema =
document.createElementNS(XMLConstants.W3C_XML_SCHEMA_NS_URI, "xsd:schema");
+ section.setAny(inlineSchema);
+
+ Element schemaElement = client.getSchemaElement(section);
+ assertSame(inlineSchema, schemaElement);
+ assertEquals(0, client.getDownloadSchemaInvocations());
+ }
+
+ private static final class TestableAbstractSTSClient extends
AbstractSTSClient {
+ private int downloadSchemaInvocations;
+ private String lastDownloadedLocation;
+
+ TestableAbstractSTSClient(Bus bus) {
+ super(bus);
+ }
+
+ @Override
+ protected Element downloadSchema(String schemaLocation) {
+ downloadSchemaInvocations++;
+ lastDownloadedLocation = schemaLocation;
+ Document document = DOMUtils.createDocument();
+ return
document.createElementNS(XMLConstants.W3C_XML_SCHEMA_NS_URI, "xsd:schema");
+ }
+
+ int getDownloadSchemaInvocations() {
+ return downloadSchemaInvocations;
+ }
+
+ String getLastDownloadedLocation() {
+ return lastDownloadedLocation;
+ }
+ }
+}
