(cxf) branch main updated: [CXF-9227] Fix SecurityManager permission regressions introduced in 4.1.7 (#3256)

[ffang]

This is an automated email from the ASF dual-hosted git repository.

ffang pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/main by this push:
     new 316973a16e4 [CXF-9227] Fix SecurityManager permission regressions 
introduced in 4.1.7 (#3256)
316973a16e4 is described below

commit 316973a16e40c74f7b7e8dd98881cbb5df977bce
Author: Freeman(Yue) Fang <freeman.f...@gmail.com>
AuthorDate: Mon Jun 29 08:54:39 2026 -0400

    [CXF-9227] Fix SecurityManager permission regressions introduced in 4.1.7 
(#3256)
---
 core/src/main/java/org/apache/cxf/resource/URIResolver.java | 13 ++++++++++++-
 .../apache/cxf/ws/addressing/EndpointReferenceUtils.java    | 12 +++++++++++-
 .../java/org/apache/cxf/transport/http/ProxyFactory.java    |  5 ++++-
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/core/src/main/java/org/apache/cxf/resource/URIResolver.java 
b/core/src/main/java/org/apache/cxf/resource/URIResolver.java
index 55ed557bef7..1a823839b7d 100644
--- a/core/src/main/java/org/apache/cxf/resource/URIResolver.java
+++ b/core/src/main/java/org/apache/cxf/resource/URIResolver.java
@@ -32,6 +32,8 @@ import java.net.URLDecoder;
 import java.nio.file.Files;
 import java.security.AccessController;
 import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
@@ -271,7 +273,16 @@ public class URIResolver implements AutoCloseable {
 
     private HttpURLConnection createInputStream() throws IOException {
         checkAllowedScheme(url);
-        HttpURLConnection huc = (HttpURLConnection)url.openConnection();
+        // Wrap the network connection in doPrivileged so that callers 
(including
+        // user deployments) do not need SocketPermission for the target host.
+        final HttpURLConnection huc;
+        try {
+            huc = AccessController.doPrivileged(
+                (PrivilegedExceptionAction<HttpURLConnection>) () ->
+                    (HttpURLConnection)url.openConnection());
+        } catch (PrivilegedActionException e) {
+            throw (IOException) e.getException();
+        }
 
         String host = SystemPropertyAction.getPropertyOrNull("http.proxyHost");
         if (host != null) {
diff --git 
a/core/src/main/java/org/apache/cxf/ws/addressing/EndpointReferenceUtils.java 
b/core/src/main/java/org/apache/cxf/ws/addressing/EndpointReferenceUtils.java
index cd95087fe52..d6bf974f51f 100644
--- 
a/core/src/main/java/org/apache/cxf/ws/addressing/EndpointReferenceUtils.java
+++ 
b/core/src/main/java/org/apache/cxf/ws/addressing/EndpointReferenceUtils.java
@@ -27,6 +27,8 @@ import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -199,7 +201,15 @@ public final class EndpointReferenceUtils {
                     systemId = publicId;
                 }
                 if (systemId != null) {
-                    InputSource source = resolver.resolve(systemId, baseURI);
+                    // Run inside doPrivileged so that sm.checkPermission() 
calls
+                    // inside the resolver chain (SecurityActions.fileExists) 
stop
+                    // at this boundary and check only CXF's own permissions 
rather
+                    // than walking up through the JAXP schema-validator 
frames that
+                    // lack CXF-internal permissions.
+                    final String sid = systemId;
+                    final String buri = baseURI;
+                    InputSource source = AccessController.doPrivileged(
+                        (PrivilegedAction<InputSource>) () -> 
resolver.resolve(sid, buri));
                     if (source != null) {
                         impl = new LSInputImpl();
                         impl.setByteStream(source.getByteStream());
diff --git 
a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/ProxyFactory.java
 
b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/ProxyFactory.java
index 30deabdb131..95049e989f2 100644
--- 
a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/ProxyFactory.java
+++ 
b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/ProxyFactory.java
@@ -22,6 +22,8 @@ import java.net.InetSocketAddress;
 import java.net.Proxy;
 import java.net.ProxySelector;
 import java.net.URI;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.List;
 import java.util.regex.Pattern;
 
@@ -50,7 +52,8 @@ public class ProxyFactory {
      * are honoured rather than bypassed.
      */
     private Proxy getSystemProxy(URI uri) {
-        ProxySelector selector = ProxySelector.getDefault();
+        ProxySelector selector = AccessController.doPrivileged(
+            (PrivilegedAction<ProxySelector>) ProxySelector::getDefault);
         if (selector == null) {
             return null;
         }