This is an automated email from the ASF dual-hosted git repository. jamesbognar pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/juneau.git
commit 88b28c4cb19b48aca3075df5842083a6818f4932 Author: James Bognar <[email protected]> AuthorDate: Sun Aug 16 21:22:28 2026 -0400 READY-396: Correct @Url/baseUrl parity docs and add classic-engine SSRF parity tests Fixes the @Url / baseUrl() javadoc on Url and the RemoteOp/verb annotations to correctly document that the classic getRemote(...) engine honors these overrides too (previously described as next-gen-only), with the same http/https-only scheme guard. The classic-engine RemoteProxyUtils_Test that covers this parity (added in a prior commit's worktree) is folded into the READY-392 commit instead, since it now also carries that item's deny-private test cases in the same file. --- .../juneau-rest-common/src/main/java/org/apache/juneau/http/Url.java | 4 ++-- .../src/main/java/org/apache/juneau/http/remote/RemoteDelete.java | 4 ++-- .../src/main/java/org/apache/juneau/http/remote/RemoteGet.java | 4 ++-- .../src/main/java/org/apache/juneau/http/remote/RemoteOp.java | 4 ++-- .../src/main/java/org/apache/juneau/http/remote/RemotePatch.java | 4 ++-- .../src/main/java/org/apache/juneau/http/remote/RemotePost.java | 4 ++-- .../src/main/java/org/apache/juneau/http/remote/RemotePut.java | 4 ++-- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/Url.java b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/Url.java index f6103c83f3..b8790b24f7 100644 --- a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/Url.java +++ b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/Url.java @@ -67,8 +67,8 @@ import java.lang.annotation.*; * Only <c>http</c>/<c>https</c> schemes are permitted; other schemes (e.g. <c>file:</c>, <c>gopher:</c>) are * rejected (SSRF guardrail). * <li class='note'> - * Honored by the next-generation engine (<c>RestClient.remote(...)</c>) only; the classic engine currently - * ignores this annotation. + * Honored by both the next-generation engine (<c>RestClient.remote(...)</c>) and the classic engine + * (<c>RestClient.getRemote(...)</c>), with the same http/https-only scheme guard on both. * </ul> * * <h5 class='section'>See Also:</h5><ul> diff --git a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteDelete.java b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteDelete.java index 6b08cf4440..eb1b7ffefa 100644 --- a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteDelete.java +++ b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteDelete.java @@ -147,8 +147,8 @@ public @interface RemoteDelete { * Only <c>http</c>/<c>https</c> schemes are permitted when the override yields an absolute URL; other schemes * are rejected (SSRF guardrail). * <li class='note'> - * Honored by the next-generation engine (<c>RestClient.remote(...)</c>) only; the classic engine currently - * ignores this attribute. + * Honored by both the next-generation engine (<c>RestClient.remote(...)</c>) and the classic engine + * (<c>RestClient.getRemote(...)</c>), with the same http/https-only scheme guard on both. * </ul> * * @return The annotation value. diff --git a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteGet.java b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteGet.java index 114187176e..0231b73212 100644 --- a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteGet.java +++ b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteGet.java @@ -147,8 +147,8 @@ public @interface RemoteGet { * Only <c>http</c>/<c>https</c> schemes are permitted when the override yields an absolute URL; other schemes * are rejected (SSRF guardrail). * <li class='note'> - * Honored by the next-generation engine (<c>RestClient.remote(...)</c>) only; the classic engine currently - * ignores this attribute. + * Honored by both the next-generation engine (<c>RestClient.remote(...)</c>) and the classic engine + * (<c>RestClient.getRemote(...)</c>), with the same http/https-only scheme guard on both. * </ul> * * @return The annotation value. diff --git a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteOp.java b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteOp.java index a3a8c2dbbe..4cfed67d6e 100644 --- a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteOp.java +++ b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemoteOp.java @@ -172,8 +172,8 @@ public @interface RemoteOp { * Only <c>http</c>/<c>https</c> schemes are permitted when the override yields an absolute URL; other schemes * are rejected (SSRF guardrail). * <li class='note'> - * Honored by the next-generation engine (<c>RestClient.remote(...)</c>) only; the classic engine currently - * ignores this attribute. + * Honored by both the next-generation engine (<c>RestClient.remote(...)</c>) and the classic engine + * (<c>RestClient.getRemote(...)</c>), with the same http/https-only scheme guard on both. * </ul> * * @return The annotation value. diff --git a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePatch.java b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePatch.java index af255f6c3b..2ff92c6bbc 100644 --- a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePatch.java +++ b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePatch.java @@ -147,8 +147,8 @@ public @interface RemotePatch { * Only <c>http</c>/<c>https</c> schemes are permitted when the override yields an absolute URL; other schemes * are rejected (SSRF guardrail). * <li class='note'> - * Honored by the next-generation engine (<c>RestClient.remote(...)</c>) only; the classic engine currently - * ignores this attribute. + * Honored by both the next-generation engine (<c>RestClient.remote(...)</c>) and the classic engine + * (<c>RestClient.getRemote(...)</c>), with the same http/https-only scheme guard on both. * </ul> * * @return The annotation value. diff --git a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePost.java b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePost.java index 2656613fc2..fc74e4896e 100644 --- a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePost.java +++ b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePost.java @@ -147,8 +147,8 @@ public @interface RemotePost { * Only <c>http</c>/<c>https</c> schemes are permitted when the override yields an absolute URL; other schemes * are rejected (SSRF guardrail). * <li class='note'> - * Honored by the next-generation engine (<c>RestClient.remote(...)</c>) only; the classic engine currently - * ignores this attribute. + * Honored by both the next-generation engine (<c>RestClient.remote(...)</c>) and the classic engine + * (<c>RestClient.getRemote(...)</c>), with the same http/https-only scheme guard on both. * </ul> * * @return The annotation value. diff --git a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePut.java b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePut.java index 988a22243e..8e0d18ebc4 100644 --- a/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePut.java +++ b/juneau-rest/juneau-rest-common/src/main/java/org/apache/juneau/http/remote/RemotePut.java @@ -146,8 +146,8 @@ public @interface RemotePut { * Only <c>http</c>/<c>https</c> schemes are permitted when the override yields an absolute URL; other schemes * are rejected (SSRF guardrail). * <li class='note'> - * Honored by the next-generation engine (<c>RestClient.remote(...)</c>) only; the classic engine currently - * ignores this attribute. + * Honored by both the next-generation engine (<c>RestClient.remote(...)</c>) and the classic engine + * (<c>RestClient.getRemote(...)</c>), with the same http/https-only scheme guard on both. * </ul> * * @return The annotation value.
