This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-xmlschema.git
The following commit(s) were added to refs/heads/master by this push:
new b4f79d3d Updating Security document with latest DefaultURIResolver
changes
b4f79d3d is described below
commit b4f79d3dcd85ee1a5cf0bda06fd60c305e31fbf3
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Thu Sep 24 13:55:49 2026 +0100
Updating Security document with latest DefaultURIResolver changes
---
SECURITY.md | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/SECURITY.md b/SECURITY.md
index 071e4408..80b5d4fb 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -35,9 +35,20 @@ findings are triaged are documented in
[THREAT-MODEL.md](./THREAT-MODEL.md).
`XmlSchemaCollection` follows `xs:import` / `xs:include` /
`xs:redefine` schema locations through a `URIResolver`. The bundled
-`DefaultURIResolver` restricts the URI schemes it will resolve, but
-applies no host or address filtering, and is a convenience default for
-trusted, operator-controlled schema sets.
+`DefaultURIResolver` restricts the URI schemes it will resolve; refuses a
+location that changes the scheme of a remote base, a `file:` location
+naming a remote host, a `jar:` archive fetched over the network, and a
+local location that is not a regular file; refuses remote addresses in
+classes that never serve a schema (link-local, which includes cloud
+metadata endpoints, multicast, wildcard and IPv6 unique-local; see
+`org.apache.ws.commons.schema.remote.checkAddresses`, which is skipped when
+a proxy carries the fetch); and bounds each remote fetch in time, bytes and
+redirects. It has no host allowlist:
+any routable host, loopback or private address, or readable local file
+that a schema location names is fetched. An operator with no remote, or no
+local, schema sets can turn that transport off (see README.txt). The
+bundled resolver is a convenience default for trusted, operator-controlled
+schema sets.
**An application that parses schema or WSDL documents from an untrusted
source must install a restricting resolver via
@@ -48,5 +59,6 @@ downstream responsibilities.
A report that the bundled default resolver dereferenced an attacker-supplied
`schemaLocation` is a documented property of that default, not a
vulnerability in the library (THREAT-MODEL.md section 9 and section 14
-Q12). A report that the resolver's scheme or base-scheme checks can be
-bypassed *is* in scope, and should be reported through the process above.
+Q12). A report that one of the checks or bounds the resolver does apply,
+listed above, can be bypassed *is* in scope, and should be reported through
+the process above.
