github-advanced-security[bot] commented on code in PR #689:
URL: https://github.com/apache/ws-wss4j/pull/689#discussion_r4004653389
##########
ws-security-common/src/main/java/org/apache/wss4j/common/util/Loader.java:
##########
@@ -36,49 +39,142 @@
* <p/>
*/
public final class Loader {
+
+ /**
+ * System property holding a comma-separated list of URL schemes that
+ * {@link #loadInputStream(ClassLoader, String)} is allowed to open when a
resource
+ * string parses as a URL. The default is "file,jar": remote fetching of
configured
+ * resources (keystores, truststores, CRLs, properties files) over e.g.
http is not
+ * enabled unless explicitly configured. For a nested-URL scheme such as
"jar"
+ * (<code>jar:<url>!/<entry></code>), the embedded URL must
use an allowed
+ * scheme as well: "jar:file:..." is permitted by default,
"jar:http://..."; is not.
+ */
+ public static final String ALLOWED_URL_SCHEMES_PROPERTY =
+ "org.apache.wss4j.loader.allowedUrlSchemes";
+
+ private static final String DEFAULT_ALLOWED_URL_SCHEMES = "file,jar";
+
private static final org.slf4j.Logger LOG =
org.slf4j.LoggerFactory.getLogger(Loader.class);
private Loader() {
// complete
}
+ /**
+ * Load a resource as a stream. The resolution order is:
+ * <ol>
+ * <li>the file system - an existing file wins, so that a path configured
by the
+ * operator cannot be shadowed by a same-named classpath resource;</li>
+ * <li>a URL, if the resource string parses as one and its scheme is in
the allowed
+ * list (see {@link #ALLOWED_URL_SCHEMES_PROPERTY}; "file" and "jar" by
default) -
+ * for a nested-URL scheme such as "jar", the embedded URL's scheme must
also be in
+ * the allowed list;</li>
+ * <li>the classpath.</li>
+ * </ol>
+ * Note: prior to the introduction of this ordering, URLs (any scheme) and
the
+ * classpath were consulted before the file system.
+ */
public static InputStream loadInputStream(ClassLoader loader, String
resource)
throws WSSecurityException, IOException {
InputStream is = null;
if (resource != null) {
+ //
+ // First look on the file system
+ //
+ Path path = null;
+ try {
+ path = Paths.get(resource);
+ } catch (InvalidPathException ex) { //NOPMD
+ // skip - not a valid file system path
+ }
+ if (path != null && Files.exists(path)) {
+ try {
+ return Files.newInputStream(path);
+ } catch (Exception e) {
+ LOG.debug(e.getMessage(), e);
+ throw new WSSecurityException(
+ WSSecurityException.ErrorCode.FAILURE, e,
"resourceNotFound", new Object[] {resource}
+ );
+ }
+ }
+
+ // Next see if it's a URL with an allowed scheme
URL url = null;
- // First see if it's a URL
try {
url = new URL(resource);
} catch (MalformedURLException ex) { //NOPMD
// skip
}
- // If not a URL, then try to load the resource
+ String disallowedScheme = url == null ? null :
findDisallowedScheme(url);
+ if (disallowedScheme != null) {
+ LOG.warn("Not loading resource [" + resource + "]: URL scheme
\"" + disallowedScheme
+ + "\" is not allowed. Set the " +
ALLOWED_URL_SCHEMES_PROPERTY
+ + " system property to permit additional schemes.");
Review Comment:
## CodeQL / Insertion of sensitive information into log files
This [potentially sensitive information](1) is written to a log file.
[Show more
details](https://github.com/apache/ws-wss4j/security/code-scanning/421)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
