(cxf) branch 4.1.x-fixes updated: Plug URIResolver into StaxUtils (#3293)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/4.1.x-fixes by this push:
     new dbb8b0111ca Plug URIResolver into StaxUtils (#3293)
dbb8b0111ca is described below

commit dbb8b0111ca7195978a9526358d3665fa59a406e
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Thu Jul 9 09:49:08 2026 +0100

    Plug URIResolver into StaxUtils (#3293)
    
    (cherry picked from commit 2f715e930cf48cdb6cc7aa579a370f779f606bc6)
---
 core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java  |  2 ++
 .../test/java/org/apache/cxf/staxutils/StaxUtilsTest.java   | 13 +++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java 
b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java
index 1062d3daf48..795e68500d6 100644
--- a/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java
+++ b/core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java
@@ -93,6 +93,7 @@ import org.apache.cxf.common.util.SystemPropertyAction;
 import org.apache.cxf.helpers.CastUtils;
 import org.apache.cxf.helpers.DOMUtils;
 import org.apache.cxf.message.Message;
+import org.apache.cxf.resource.URIResolver;
 
 public final class StaxUtils {
     // System properties for defaults, but also contextual properties usable
@@ -1693,6 +1694,7 @@ public final class StaxUtils {
         } else {
             try {
                 final URL url = new URL(sysId);
+                URIResolver.checkAllowedScheme(url);
                 final InputStream is = url.openStream();
                 final StreamSource ss = new StreamSource(is, sysId);
                 ss.setPublicId(pubId);
diff --git a/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java 
b/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java
index d2272da7b4d..54b1c0ba657 100644
--- a/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java
+++ b/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java
@@ -72,6 +72,19 @@ public class StaxUtilsTest {
         assertNotNull(reader);
     }
 
+    @Test
+    public void testCreateXMLStreamReaderInputSourceHonorsAllowedSchemes() 
throws Exception {
+        InputSource source = new InputSource();
+        source.setSystemId("ftp://127.0.0.1/test.xml";);
+
+        try {
+            StaxUtils.createXMLStreamReader(source);
+            fail("Failure expected on disallowed scheme");
+        } catch (IllegalArgumentException ex) {
+            assertEquals("InputSource must have a ByteStream or 
CharacterStream", ex.getMessage());
+        }
+    }
+
     private InputStream getTestStream(String resource) {
         return getClass().getResourceAsStream(resource);
     }