This is an automated email from the ASF dual-hosted git repository. robertlazarski pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit 75191f775288d0f068f3ffc1c6e337f7b889b2f7 Author: Robert Lazarski <[email protected]> AuthorDate: Wed Aug 5 09:05:06 2026 -1000 Do not follow redirects when sending a decoupled response The scheme allow-list and the address checks both run against the endpoint reference the caller supplied, and nothing re-examines where a redirect leads. HttpClientBuilder is used with defaults here, and RequestConfig.DEFAULT has redirects enabled with a limit of 50, so a caller whose own reply endpoint answers 307 could name somewhere the policy had already refused -- the HTTP-only instance-metadata address being the obvious one. That is precisely the protocol-downgrade route past an HTTPS-only allow-list. Redirects are now disabled for a server-side send to a non-anonymous destination, which is exactly the decoupled-response case. The reply is fire-and-forget, so nothing legitimate depends on following one. Ordinary client-side requests are untouched. The test drives the real RequestImpl against a local server that answers 307, and asserts the rebound target is never reached. It carries a control that sends the same request client-side and asserts the target IS reached, so the main assertion cannot pass by the request simply failing, plus an anonymous server-side case to show the restriction is scoped and not blanket. Co-Authored-By: Claude Fable 5 <[email protected]> --- .../http/impl/httpclient5/RequestImpl.java | 15 +++ .../httpclient5/DecoupledResponseRedirectTest.java | 148 +++++++++++++++++++++ 2 files changed, 163 insertions(+) diff --git a/modules/transport/http/src/main/java/org/apache/axis2/transport/http/impl/httpclient5/RequestImpl.java b/modules/transport/http/src/main/java/org/apache/axis2/transport/http/impl/httpclient5/RequestImpl.java index 1e69b03d1d..5901857651 100644 --- a/modules/transport/http/src/main/java/org/apache/axis2/transport/http/impl/httpclient5/RequestImpl.java +++ b/modules/transport/http/src/main/java/org/apache/axis2/transport/http/impl/httpclient5/RequestImpl.java @@ -28,6 +28,7 @@ import java.util.Map; import org.apache.axiom.mime.Header; import org.apache.axis2.AxisFault; +import org.apache.axis2.addressing.EndpointReference; import org.apache.axis2.context.MessageContext; import org.apache.axis2.kernel.http.HTTPConstants; import org.apache.axis2.transport.http.AxisRequestEntity; @@ -236,6 +237,20 @@ final class RequestImpl implements Request { requestConfig.setCookieSpec(cookiePolicy); } + // A server-side send to a non-anonymous destination is a WS-Addressing + // decoupled response, and the destination came from the caller. The scheme + // and address checks in AddressingResponseEndpointPolicy ran against that + // destination only, so following a redirect would step straight past them: + // a 307 from the caller's own endpoint to http://169.254.169.254/ would be + // honoured even though neither the scheme nor the address would have + // passed. The reply is fire-and-forget, so nothing legitimate needs the + // redirect. + EndpointReference to = msgContext.getTo(); + if (msgContext.isServerSide() && to != null + && !to.hasAnonymousAddress() && !to.hasNoneAddress()) { + requestConfig.setRedirectsEnabled(false); + } + clientContext.setRequestConfig(requestConfig.build()); // AXIS2-6051, the move from javax to jakarta // broke HTTPClient by sending Content-Length, diff --git a/modules/transport/http/src/test/java/org/apache/axis2/transport/http/impl/httpclient5/DecoupledResponseRedirectTest.java b/modules/transport/http/src/test/java/org/apache/axis2/transport/http/impl/httpclient5/DecoupledResponseRedirectTest.java new file mode 100644 index 0000000000..0f2a809573 --- /dev/null +++ b/modules/transport/http/src/test/java/org/apache/axis2/transport/http/impl/httpclient5/DecoupledResponseRedirectTest.java @@ -0,0 +1,148 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.axis2.transport.http.impl.httpclient5; + +import com.sun.net.httpserver.HttpExchange; +import com.sun.net.httpserver.HttpHandler; +import com.sun.net.httpserver.HttpServer; +import junit.framework.TestCase; +import org.apache.axis2.addressing.AddressingConstants; +import org.apache.axis2.addressing.EndpointReference; +import org.apache.axis2.context.ConfigurationContext; +import org.apache.axis2.context.MessageContext; +import org.apache.axis2.engine.AxisConfiguration; +import org.apache.hc.client5.http.classic.HttpClient; +import org.apache.hc.client5.http.impl.classic.HttpClientBuilder; + +import java.io.IOException; +import java.io.OutputStream; +import java.net.InetSocketAddress; +import java.net.URI; +import java.util.concurrent.atomic.AtomicBoolean; + +/** + * A decoupled WS-Addressing response must not follow redirects. + * + * <p>The destination of such a response is chosen by the caller, and + * {@code AddressingResponseEndpointPolicy} screens that destination — its + * scheme and the address it resolves to — before the send. A redirect is + * evaluated by no one: the caller's own endpoint can answer 307 and name + * somewhere the policy would have refused, such as the HTTP-only + * instance-metadata address, and the client would honour it. That is the + * protocol-downgrade route around the scheme allow-list, so redirects are + * disabled for this kind of send. + */ +public class DecoupledResponseRedirectTest extends TestCase { + + private HttpServer server; + private final AtomicBoolean redirectTargetHit = new AtomicBoolean(); + private int port; + + protected void setUp() throws Exception { + super.setUp(); + redirectTargetHit.set(false); + server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0); + port = server.getAddress().getPort(); + + // Stands in for the caller's own reply endpoint, which answers with a + // redirect rather than accepting the response. + server.createContext("/cb", new HttpHandler() { + public void handle(HttpExchange exchange) throws IOException { + drain(exchange); + exchange.getResponseHeaders().add("Location", + "http://127.0.0.1:"; + port + "/rebound"); + exchange.sendResponseHeaders(307, -1); + exchange.close(); + } + }); + + // Stands in for the address the policy would never have permitted. + server.createContext("/rebound", new HttpHandler() { + public void handle(HttpExchange exchange) throws IOException { + redirectTargetHit.set(true); + drain(exchange); + exchange.sendResponseHeaders(200, -1); + exchange.close(); + } + }); + server.start(); + } + + protected void tearDown() throws Exception { + server.stop(0); + super.tearDown(); + } + + private static void drain(HttpExchange exchange) throws IOException { + exchange.getRequestBody().readAllBytes(); + } + + /** The case that matters: a server-side reply to a caller-named endpoint. */ + public void testDecoupledResponseDoesNotFollowRedirect() throws Exception { + send(true, new EndpointReference("http://127.0.0.1:"; + port + "/cb")); + assertFalse("A decoupled response must not follow a redirect off the " + + "endpoint the policy screened", redirectTargetHit.get()); + } + + /** + * The control. Without it the test above proves nothing — it would pass just + * as well if the request never left the building. + */ + public void testClientRequestStillFollowsRedirect() throws Exception { + send(false, new EndpointReference("http://127.0.0.1:"; + port + "/cb")); + assertTrue("An ordinary client-side request should still follow redirects", + redirectTargetHit.get()); + } + + /** + * An anonymous reply travels back down the inbound connection and is not a + * caller-named destination, so it keeps the default behaviour. + */ + public void testAnonymousServerResponseIsUnaffected() throws Exception { + MessageContext mc = newContext(true, + new EndpointReference(AddressingConstants.Final.WSA_ANONYMOUS_URL)); + // The request URI is what is actually dialled; the anonymous To is what + // decides whether the restriction applies. + execute(mc, "http://127.0.0.1:"; + port + "/cb"); + assertTrue("An anonymous server-side reply should keep default redirect " + + "handling", redirectTargetHit.get()); + } + + private void send(boolean serverSide, EndpointReference to) throws Exception { + execute(newContext(serverSide, to), to.getAddress()); + } + + private MessageContext newContext(boolean serverSide, EndpointReference to) + throws Exception { + ConfigurationContext cc = new ConfigurationContext(new AxisConfiguration()); + MessageContext mc = cc.createMessageContext(); + mc.setServerSide(serverSide); + mc.setTo(to); + return mc; + } + + private void execute(MessageContext mc, String uri) throws Exception { + HttpClient client = HttpClientBuilder.create().build(); + RequestImpl request = + new RequestImpl(client, mc, "POST", URI.create(uri), null); + request.execute(); + request.releaseConnection(); + } +}
