On Sat, 19 Sep 2026 07:38:16 GMT, Alan Bateman <[email protected]> wrote:
>> Joe Wang has updated the pull request incrementally with one additional
>> commit since the last revision:
>>
>> test: fix system id
>
> src/java.xml/share/classes/com/sun/org/apache/xerces/internal/impl/XMLEntityManager.java
> line 1367:
>
>> 1365: if (!fISCreatedByResolver) {
>> 1366: String accessError =
>> SecuritySupport.checkAccess(expandedSystemId, fSecurityManager,
>> 1367: XMLConstants.ACCESS_EXTERNAL_DTD,
>> fAccessExternalDTD);
>
> Would it be possible to say how this works with HTTP redirects? I can't tell
> if expandedSystemId is the original URL or the "final" URL in this check.
>
> I think my question is really asking if the value of jdk.xml.resource.access
> needs to allow both the original and the final URL.
expandedSystemId is the URI resolved by the parser (with base id or working dir
if not absolute), and against which the property checks. If the resource
requested by the XML document is permitted by the specified rule, the parser
proceeds to establish the connection. HTTP redirects occur after this check and
are outside the parser's control.
A redirect will work as expected if access rule is specified against the
originally requested resource. For example, if a site hosting DTDs is moved or
retired, requests to those DTDs can continue to work when they are redirected
to a new host.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/32098#discussion_r4056174860
