[
https://issues.apache.org/jira/browse/AXIS2-4282?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12688713#action_12688713
]
Jarek Gawor commented on AXIS2-4282:
------------------------------------
WSDL parser resolves relative imports based on the location of the document
which has those imports. So for example if "META-INF/dir1/dir2/test.wsdl"
document has an import on "../test.xsd" then this will resolve to
"META-INF/dir1/test.xsd". If the document is a file url or jar url or whatever
url, the relative import will still be the same type of url just with the
resolved path as described before.
But this issue and fix has nothing to do with how wsdl and xsd imports are
handled or resolved. The classloader that is tied to a particular directory
must only serve resources and classes from within that directory. The fix
ensures that. That's all.
> JarFileClassLoader allows resources to be loaded from locations outside of
> the directory specified in its classpath
> -------------------------------------------------------------------------------------------------------------------
>
> Key: AXIS2-4282
> URL: https://issues.apache.org/jira/browse/AXIS2-4282
> Project: Axis 2.0 (Axis2)
> Issue Type: Bug
> Components: kernel
> Affects Versions: 1.5, nightly
> Reporter: Jarek Gawor
> Assignee: Jarek Gawor
> Fix For: 1.5, nightly
>
>
> If JarFileClassLoader contains one classpath entry that is a directory, it
> will allow resources to be loaded from ANY directory on the file system.
> The JarFileClassLoader should of course only allow resources to be loaded
> from within the directory specified.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
