On Sun, 20 Sep 2026 05:04:15 GMT, Joe Wang <[email protected]> wrote:
>> src/java.xml/share/classes/com/sun/org/apache/xerces/internal/impl/XMLEntityManager.java
>> line 1367:
>>
>>> 1365: if (!fISCreatedByResolver) {
>>> 1366: String accessError =
>>> SecuritySupport.checkAccess(expandedSystemId, fSecurityManager,
>>> 1367: XMLConstants.ACCESS_EXTERNAL_DTD,
>>> fAccessExternalDTD);
>>
>> Would it be possible to say how this works with HTTP redirects? I can't tell
>> if expandedSystemId is the original URL or the "final" URL in this check.
>>
>> I think my question is really asking if the value of jdk.xml.resource.access
>> needs to allow both the original and the final URL.
>
> expandedSystemId is the URI resolved by the parser (with base id or working
> dir if not absolute), and against which the property checks. If the resource
> requested by the XML document is permitted by the specified rule, the parser
> proceeds to establish the connection. HTTP redirects occur after this check
> and are outside the parser's control.
>
> A redirect will work as expected if access rule is specified against the
> originally requested resource. For example, if a site hosting DTDs is moved
> or retired, requests to those DTDs can continue to work when they are
> redirected to a new host.
Thanks, I need to mull over this and whether disabling redirects might be
required in some cases.
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/32098#discussion_r4056442609
