This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/staxutils in repository https://gitbox.apache.org/repos/asf/cxf.git
commit e96a3f165b707526c3d268bc145f88c27236410f Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Wed Jul 8 10:11:48 2026 +0100 Plug URIResolver into StaxUtils --- core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java | 2 ++ .../test/java/org/apache/cxf/staxutils/StaxUtilsTest.java | 13 +++++++++++++ 2 files changed, 15 insertions(+) diff --git a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java index 1062d3daf48..795e68500d6 100644 --- a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java +++ b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java @@ -93,6 +93,7 @@ import org.apache.cxf.common.util.SystemPropertyAction; import org.apache.cxf.helpers.CastUtils; import org.apache.cxf.helpers.DOMUtils; import org.apache.cxf.message.Message; +import org.apache.cxf.resource.URIResolver; public final class StaxUtils { // System properties for defaults, but also contextual properties usable @@ -1693,6 +1694,7 @@ public final class StaxUtils { } else { try { final URL url = new URL(sysId); + URIResolver.checkAllowedScheme(url); final InputStream is = url.openStream(); final StreamSource ss = new StreamSource(is, sysId); ss.setPublicId(pubId); diff --git a/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java b/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java index d2272da7b4d..54b1c0ba657 100644 --- a/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java +++ b/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java @@ -72,6 +72,19 @@ public class StaxUtilsTest { assertNotNull(reader); } + @Test + public void testCreateXMLStreamReaderInputSourceHonorsAllowedSchemes() throws Exception { + InputSource source = new InputSource(); + source.setSystemId("ftp://127.0.0.1/test.xml";); + + try { + StaxUtils.createXMLStreamReader(source); + fail("Failure expected on disallowed scheme"); + } catch (IllegalArgumentException ex) { + assertEquals("InputSource must have a ByteStream or CharacterStream", ex.getMessage()); + } + } + private InputStream getTestStream(String resource) { return getClass().getResourceAsStream(resource); }
