This is an automated email from the ASF dual-hosted git repository.
jamesbognar pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/juneau.git
from ae4cc786c7 Fix flaky MCP tools/call schema-validation timeout under
load: decouple validation compute budget from the structural-traversal
wall-clock deadline
new 25a0ec4075 READY-389/390: Shared parse-depth budget + narrowed OOM
catch in ParserSession
new 88b28c4cb1 READY-396: Correct @Url/baseUrl parity docs and add
classic-engine SSRF parity tests
new 4654fee99b READY-392: Replace scheme-only @Remote SSRF guard with
deny-private, pin-on-connect, and redirect-revalidation
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../juneau/marshall/cbor/CborParserSession.java | 15 +-
.../marshall/msgpack/MsgPackParserSession.java | 26 +-
.../juneau/marshall/parser/ParserSession.java | 105 ++++++-
.../marshall/protobuf/ProtobufParserSession.java | 16 +-
.../marshall/cbor/CborParser_ParseDepth_Test.java | 73 +++++
.../juneau/marshall/parser/ParserSession_Test.java | 102 ++++++-
.../protobuf/ProtobufParser_ParseDepth_Test.java | 86 ++++++
.../http/remote/Remote_CommonInterfaces_Test.java | 18 +-
.../http/remote/Remote_ContentAnnotation_Test.java | 6 +-
.../remote/Remote_FormDataAnnotation_Test.java | 6 +-
.../http/remote/Remote_HeaderAnnotation_Test.java | 4 +-
.../Remote_MethodDefaultsAnnotation_Test.java | 44 +--
.../http/remote/Remote_PathAnnotation_Test.java | 4 +-
.../http/remote/Remote_QueryAnnotation_Test.java | 4 +-
.../remote/Remote_RemoteOpAnnotation_Test.java | 6 +-
.../http/remote/Remote_RequestAnnotation_Test.java | 2 +-
.../remote/Remote_ResponseAnnotation_Test.java | 4 +-
.../org/apache/juneau/http/remote/Remote_Test.java | 8 +-
.../rest/client/RemoteInterfaceTransport_Test.java | 4 +
.../rest/test/client/ThirdPartyProxy_Test.java | 2 +-
.../juneau/petstore/jetty/PetStoreClient_Test.java | 3 +
.../apachehttpclient45/ApacheHc45Transport.java | 53 +++-
.../PolicyAwareRedirectStrategy.java | 45 +++
.../PolicyPinningDnsResolver.java | 48 ++++
.../apachehttpclient50/ApacheHc5Transport.java | 46 +++-
.../PolicyAwareRedirectStrategy.java | 45 +++
.../PolicyPinningDnsResolver.java | 52 ++++
.../classic/PolicyAwareRedirectStrategy.java | 46 ++++
.../client/classic/PolicyPinningDnsResolver.java | 50 ++++
.../juneau/rest/client/classic/RestClient.java | 86 +++++-
.../juneau/rest/client/classic/RestRequest.java | 93 ++++++-
.../rest/client/classic/remote/RemoteMeta.java | 12 +
.../client/classic/remote/RemoteProxyUtils.java | 45 ++-
.../classic/remote/RemoteUrlPolicyState.java | 67 +++++
.../client/classic/RemoteProxyParity_Test.java | 20 +-
.../classic/RemoteProxyThrowOnError_Test.java | 12 +-
.../client/classic/RestClient_Coverage2_Test.java | 33 ++-
.../classic/remote/RemoteProxyUtils_Test.java | 88 ++++++
.../rest/client/jetty/JettyHttpTransport.java | 52 +++-
.../jetty/PolicyPinningSocketAddressResolver.java | 58 ++++
.../juneau/rest/client/okhttp/OkHttpTransport.java | 29 +-
.../rest/client/okhttp/PolicyPinningDns.java | 49 ++++
.../apache/juneau/rest/client/HttpTransport.java | 19 ++
.../juneau/rest/client/JavaHttpTransport.java | 129 ++++++++-
.../rest/client/PolicyEnforcedRedirects.java | 156 +++++++++++
.../org/apache/juneau/rest/client/RestClient.java | 37 +++
.../org/apache/juneau/rest/client/RestRequest.java | 32 ++-
.../juneau/rest/client/TransportRequest.java | 56 ++++
.../juneau/rest/client/remote/RemoteClient.java | 66 ++---
.../juneau/rest/client/RemoteClient_Test.java | 42 +--
.../RestRequest_SsrfGuardFailClosed_Test.java | 83 ++++++
...moteClient_InvocationHandlerInternals_Test.java | 67 +----
.../remote/RemoteClient_ParseAndCursor_Test.java | 26 +-
.../RemoteClient_ReturnModesAndRetry_Test.java | 72 ++---
.../src/main/java/org/apache/juneau/http/Url.java | 4 +-
.../java/org/apache/juneau/http/remote/Remote.java | 32 ++-
.../apache/juneau/http/remote/RemoteDelete.java | 4 +-
.../org/apache/juneau/http/remote/RemoteGet.java | 4 +-
.../org/apache/juneau/http/remote/RemoteOp.java | 4 +-
.../org/apache/juneau/http/remote/RemotePatch.java | 4 +-
.../org/apache/juneau/http/remote/RemotePost.java | 4 +-
.../org/apache/juneau/http/remote/RemotePut.java | 4 +-
.../apache/juneau/http/remote/RemoteUrlPolicy.java | 287 +++++++++++++++++++
.../juneau/http/remote/RrpcInterfaceMeta.java | 16 ++
.../juneau/http/remote/RemoteUrlPolicy_Test.java | 304 +++++++++++++++++++++
.../apache/juneau/rest/mock/MockHttpTransport.java | 15 +
.../apache/juneau/rest/mock/MockRestClient.java | 17 ++
.../rest/mock/NextGenContentNegotiation_Test.java | 2 +-
.../mock/RemoteCursorBinding_NextGen_Test.java | 10 +-
.../juneau/rest/mock/RemoteCursorBinding_Test.java | 11 +-
70 files changed, 2714 insertions(+), 360 deletions(-)
create mode 100644
juneau-core/juneau-marshall/src/test/java/org/apache/juneau/marshall/cbor/CborParser_ParseDepth_Test.java
create mode 100644
juneau-core/juneau-marshall/src/test/java/org/apache/juneau/marshall/protobuf/ProtobufParser_ParseDepth_Test.java
create mode 100644
juneau-rest/juneau-rest-client-apache-httpclient-45/src/main/java/org/apache/juneau/rest/client/apachehttpclient45/PolicyAwareRedirectStrategy.java
create mode 100644
juneau-rest/juneau-rest-client-apache-httpclient-45/src/main/java/org/apache/juneau/rest/client/apachehttpclient45/PolicyPinningDnsResolver.java
create mode 100644
juneau-rest/juneau-rest-client-apache-httpclient-50/src/main/java/org/apache/juneau/rest/client/apachehttpclient50/PolicyAwareRedirectStrategy.java
create mode 100644
juneau-rest/juneau-rest-client-apache-httpclient-50/src/main/java/org/apache/juneau/rest/client/apachehttpclient50/PolicyPinningDnsResolver.java
create mode 100644
juneau-rest/juneau-rest-client-classic/src/main/java/org/apache/juneau/rest/client/classic/PolicyAwareRedirectStrategy.java
create mode 100644
juneau-rest/juneau-rest-client-classic/src/main/java/org/apache/juneau/rest/client/classic/PolicyPinningDnsResolver.java
create mode 100644
juneau-rest/juneau-rest-client-classic/src/main/java/org/apache/juneau/rest/client/classic/remote/RemoteUrlPolicyState.java
create mode 100644
juneau-rest/juneau-rest-client-classic/src/test/java/org/apache/juneau/rest/client/classic/remote/RemoteProxyUtils_Test.java
create mode 100644
juneau-rest/juneau-rest-client-jetty/src/main/java/org/apache/juneau/rest/client/jetty/PolicyPinningSocketAddressResolver.java
create mode 100644
juneau-rest/juneau-rest-client-okhttp/src/main/java/org/apache/juneau/rest/client/okhttp/PolicyPinningDns.java
create mode 100644
juneau-rest/juneau-rest-client/src/main/java/org/apache/juneau/rest/client/PolicyEnforcedRedirects.java
create mode 100644
juneau-rest/juneau-rest-client/src/test/java/org/apache/juneau/rest/client/RestRequest_SsrfGuardFailClosed_Test.java
create mode 100644
juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteUrlPolicy.java
create mode 100644
juneau-rest/juneau-rest-common/src/test/java/org/apache/juneau/http/remote/RemoteUrlPolicy_Test.java
