This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch 4.1.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit f476da825547cad80035238c59dd676ad6eaf354 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Thu Apr 23 15:49:12 2026 +0100 Add a boolean to guard against remove schema download for WS-MEX (#3054) (cherry picked from commit b1b8a9c297a9e1e152ee5338622a21e643c92a2e) --- .../cxf/ws/security/trust/AbstractSTSClient.java | 47 ++++++--- .../ws/security/trust/AbstractSTSClientTest.java | 105 +++++++++++++++++++++ 2 files changed, 139 insertions(+), 13 deletions(-) diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java index d95294581ea..8d1b68adc6a 100755 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/AbstractSTSClient.java @@ -208,6 +208,7 @@ public abstract class AbstractSTSClient implements Configurable, InterceptorProv protected List<Feature> features; protected TLSClientParameters tlsClientParameters; + protected boolean allowMexMetadataSchemaLocation; public AbstractSTSClient(Bus b) { bus = b; @@ -249,6 +250,14 @@ public abstract class AbstractSTSClient implements Configurable, InterceptorProv this.tlsClientParameters = tlsClientParameters; } + public boolean isAllowMexMetadataSchemaLocation() { + return allowMexMetadataSchemaLocation; + } + + public void setAllowMexMetadataSchemaLocation(boolean allowMexMetadataSchemaLocation) { + this.allowMexMetadataSchemaLocation = allowMexMetadataSchemaLocation; + } + /** * Sets the WS-P policy that is applied to communications between this client and the remote server * if no value is supplied for {@link #setWsdlLocation(String)}. @@ -542,19 +551,16 @@ public abstract class AbstractSTSClient implements Configurable, InterceptorProv definition = bus.getExtension(WSDLManager.class).getDefinition((Element)s.getAny()); } else if ("http://www.w3.org/2001/XMLSchema".equals(s.getDialect())) { - Element schemaElement = (Element)s.getAny(); - if (schemaElement == null) { - String schemaLocation = s.getLocation(); - LOG.info("XSD schema location: " + schemaLocation); - schemaElement = downloadSchema(schemaLocation); + Element schemaElement = getSchemaElement(s); + if (schemaElement != null) { + QName schemaName = + new QName(schemaElement.getNamespaceURI(), schemaElement.getLocalName()); + WSDLManager wsdlManager = bus.getExtension(WSDLManager.class); + ExtensibilityElement + exElement = wsdlManager.getExtensionRegistry().createExtension(Types.class, schemaName); + ((Schema)exElement).setElement(schemaElement); + schemas.add((Schema)exElement); } - QName schemaName = - new QName(schemaElement.getNamespaceURI(), schemaElement.getLocalName()); - WSDLManager wsdlManager = bus.getExtension(WSDLManager.class); - ExtensibilityElement - exElement = wsdlManager.getExtensionRegistry().createExtension(Types.class, schemaName); - ((Schema)exElement).setElement(schemaElement); - schemas.add((Schema)exElement); } } @@ -614,7 +620,22 @@ public abstract class AbstractSTSClient implements Configurable, InterceptorProv } } - private Element downloadSchema(String schemaLocation) throws Exception { + protected Element getSchemaElement(MetadataSection s) throws Exception { + Element schemaElement = (Element)s.getAny(); + if (schemaElement == null) { + if (!allowMexMetadataSchemaLocation) { + LOG.info("Loading a schema from WS-MEX MetadataSection Location is disabled by " + + " default. Enable allowMexMetadataSchemaLocation to allow it."); + } else { + String schemaLocation = s.getLocation(); + LOG.info("XSD schema location: " + schemaLocation); + schemaElement = downloadSchema(schemaLocation); + } + } + return schemaElement; + } + + protected Element downloadSchema(String schemaLocation) throws Exception { DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE); diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AbstractSTSClientTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AbstractSTSClientTest.java new file mode 100644 index 00000000000..48f43402dfb --- /dev/null +++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/trust/AbstractSTSClientTest.java @@ -0,0 +1,105 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.cxf.ws.security.trust; + +import javax.xml.XMLConstants; + +import org.w3c.dom.Document; +import org.w3c.dom.Element; + +import org.apache.cxf.Bus; +import org.apache.cxf.helpers.DOMUtils; +import org.apache.cxf.ws.mex.model._2004_09.MetadataSection; + +import org.junit.Test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertSame; +import static org.junit.Assert.assertTrue; + +public class AbstractSTSClientTest { + + @Test + public void testSchemaLocationDownloadDisabledByDefault() throws Exception { + TestableAbstractSTSClient client = new TestableAbstractSTSClient(null); + MetadataSection section = new MetadataSection(); + section.setDialect(XMLConstants.W3C_XML_SCHEMA_NS_URI); + section.setLocation("http://example.org/schema.xsd";); + + assertFalse(client.isAllowMexMetadataSchemaLocation()); + assertTrue(client.getSchemaElement(section) == null); + } + + @Test + public void testSchemaLocationDownloadAllowedWhenEnabled() throws Exception { + TestableAbstractSTSClient client = new TestableAbstractSTSClient(null); + MetadataSection section = new MetadataSection(); + section.setDialect(XMLConstants.W3C_XML_SCHEMA_NS_URI); + section.setLocation("http://example.org/schema.xsd";); + + client.setAllowMexMetadataSchemaLocation(true); + + Element schemaElement = client.getSchemaElement(section); + assertEquals(1, client.getDownloadSchemaInvocations()); + assertEquals("http://example.org/schema.xsd";, client.getLastDownloadedLocation()); + assertEquals(XMLConstants.W3C_XML_SCHEMA_NS_URI, schemaElement.getNamespaceURI()); + assertEquals("schema", schemaElement.getLocalName()); + } + + @Test + public void testInlineSchemaElementDoesNotDownload() throws Exception { + TestableAbstractSTSClient client = new TestableAbstractSTSClient(null); + MetadataSection section = new MetadataSection(); + section.setDialect(XMLConstants.W3C_XML_SCHEMA_NS_URI); + + Document document = DOMUtils.createDocument(); + Element inlineSchema = document.createElementNS(XMLConstants.W3C_XML_SCHEMA_NS_URI, "xsd:schema"); + section.setAny(inlineSchema); + + Element schemaElement = client.getSchemaElement(section); + assertSame(inlineSchema, schemaElement); + assertEquals(0, client.getDownloadSchemaInvocations()); + } + + private static final class TestableAbstractSTSClient extends AbstractSTSClient { + private int downloadSchemaInvocations; + private String lastDownloadedLocation; + + TestableAbstractSTSClient(Bus bus) { + super(bus); + } + + @Override + protected Element downloadSchema(String schemaLocation) { + downloadSchemaInvocations++; + lastDownloadedLocation = schemaLocation; + Document document = DOMUtils.createDocument(); + return document.createElementNS(XMLConstants.W3C_XML_SCHEMA_NS_URI, "xsd:schema"); + } + + int getDownloadSchemaInvocations() { + return downloadSchemaInvocations; + } + + String getLastDownloadedLocation() { + return lastDownloadedLocation; + } + } +}
