(cxf) 01/02: Plug URIResolver into AttachmentUtil (#3289)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git

commit 7d941d6e8ce1b7c1d9de305156103de685ef62ed
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Tue Jul 7 17:10:16 2026 +0100

    Plug URIResolver into AttachmentUtil (#3289)
    
    (cherry picked from commit 50918830ece560c374387230fbcd8791e26582b9)
---
 .../main/java/org/apache/cxf/attachment/AttachmentUtil.java  |  7 ++++++-
 .../apache/cxf/attachment/AttachmentDeserializerTest.java    | 12 ++++++++++++
 .../java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java  |  8 +++++---
 3 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java 
b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
index b870c447143..c7184b241ea 100644
--- a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
+++ b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
@@ -63,6 +63,7 @@ import org.apache.cxf.io.CachedOutputStream;
 import org.apache.cxf.message.Attachment;
 import org.apache.cxf.message.Message;
 import org.apache.cxf.message.MessageUtils;
+import org.apache.cxf.resource.URIResolver;
 
 public final class AttachmentUtil {
     // The default values for {@link AttachmentDataSource} content type in 
case when
@@ -593,12 +594,16 @@ public final class AttachmentUtil {
                     final boolean followUrls = 
Boolean.valueOf(SystemPropertyAction
                         .getProperty(ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY, 
"false"));
                     if (followUrls) {
-                        return new URLDataSource(new URL(contentId));
+                        final URL remoteUrl = new URL(contentId);
+                        URIResolver.checkAllowedScheme(remoteUrl);
+                        return new URLDataSource(remoteUrl);
                     } else {
                         return loadDataSource(contentId, atts);
                     }
                 } catch (MalformedURLException e) {
                     throw new Fault(e);
+                } catch (IOException e) {
+                    throw new Fault(e);
                 }
             }
         } else {
diff --git 
a/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java 
b/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java
index 1d6e2dd756e..857704c7878 100644
--- 
a/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java
+++ 
b/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java
@@ -43,6 +43,7 @@ import org.xml.sax.helpers.DefaultHandler;
 import jakarta.activation.DataSource;
 import jakarta.activation.URLDataSource;
 import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.interceptor.Fault;
 import org.apache.cxf.io.CacheSizeExceededException;
 import org.apache.cxf.message.Attachment;
 import org.apache.cxf.message.Exchange;
@@ -942,4 +943,15 @@ public class AttachmentDeserializerTest {
             
System.clearProperty(AttachmentUtil.ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY);
         }
     }
+
+    @Test
+    public void testCXF8706followUrlRejectsDisallowedScheme() {
+        System.setProperty(AttachmentUtil.ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY, 
"true");
+        try {
+            assertThrows(Fault.class, () -> AttachmentUtil
+                .getAttachmentDataSource("cid:gopher://image.com/1.gif";, 
Collections.emptyList()));
+        } finally {
+            
System.clearProperty(AttachmentUtil.ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY);
+        }
+    }
 }
diff --git 
a/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java
 
b/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java
index fbc7b21cf3b..588b4df82e2 100644
--- 
a/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java
+++ 
b/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java
@@ -18,7 +18,6 @@
  */
 package org.apache.cxf.aegis.type.mtom;
 
-import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
@@ -32,6 +31,7 @@ import org.apache.cxf.aegis.util.UID;
 import org.apache.cxf.attachment.AttachmentImpl;
 import org.apache.cxf.common.util.SystemPropertyAction;
 import org.apache.cxf.message.Attachment;
+import org.apache.cxf.resource.URIResolver;
 
 public final class AttachmentUtil {
     // The xop:include "href" attribute 
(https://www.w3.org/TR/xop10/#xop_href) may include 
@@ -78,9 +78,11 @@ public final class AttachmentUtil {
         if (followUrls) {
             // Try loading the URL remotely
             try {
-                URLDataSource source = new URLDataSource(new URL(id));
+                final URL remoteUrl = new URL(id);
+                URIResolver.checkAllowedScheme(remoteUrl);
+                URLDataSource source = new URLDataSource(remoteUrl);
                 return new AttachmentImpl(id, new DataHandler(source));
-            } catch (MalformedURLException e) {
+            } catch (java.io.IOException e) {
                 return null;
             }
         }