This is an automated email from the ASF dual-hosted git repository.

robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git

commit 8c783edfdbcd5490a0eb2bedbc3c6a797239b767
Merge: 173bad1882 cfbaf6a648
Author: Robert Lazarski <[email protected]>
AuthorDate: Tue Aug 4 08:27:21 2026 -1000

    Harden five anonymous-reachable surfaces from a private security report
    
    Reported privately via [email protected] on 2026-07-30 against
    54de37f455. All five reproduce; four are fixed here, one (F3) is
    hardened with an opt-in rather than treated as a vulnerability.
    
    F1 CWE-918  WS-Addressing ReplyTo/FaultTo drive a server-initiated 
connection
                to a caller-chosen address. Screened in AddressingInHandler, at 
the
                inbound trust boundary, rather than in the transport sender, 
which
                also carries legitimate client calls. Link-local, wildcard and
                multicast refused always; loopback and private ranges behind
                blockPrivateNetworkResponseEndpoints.
    F2 CWE-79   The Host reached an inline script unescaped in the Swagger UI 
page.
                URI.create did not neutralise it. Host validated, output 
encoded for
                the script context, inline block nonced under a CSP.
    F3 CWE-644  servers[].url followed the request Host. Added 
openapi.serverBaseUrl
                to pin it; the request-derived default still follows the Host, 
as it
                does in comparable OpenAPI implementations.
    F4 CWE-770  The multipart and form-urlencoded builders read the transport 
stream
                directly, so the container's post limit never applied. Both 
bounded,
                configurable per service. Multipart temp files are now deleted
                rather than accumulating.
    F5 CWE-862  The .xsd/.wsdl file routes, HTTPWorker's named-WSDL route and 
the
                whole OpenAPI/MCP generator ignored exposeServiceMetadata.
    
    CVEs to be requested after release, per the process followed for
    CVE-2026-66713.

 .../handlers/addressing/AddressingInHandler.java   |  23 ++
 .../addressing/ResponseEndpointPolicy.java         | 291 +++++++++++++++++++++
 .../ResponseEndpointPolicyHandlerTest.java         | 146 +++++++++++
 .../addressing/ResponseEndpointPolicyTest.java     | 213 +++++++++++++++
 modules/kernel/conf/axis2.xml                      |  44 ++++
 .../apache/axis2/builder/BoundedInputStream.java   |  90 +++++++
 .../axis2/builder/MultipartFormDataBuilder.java    |  63 ++++-
 .../axis2/builder/MultipartTempFileTracker.java    |  93 +++++++
 .../apache/axis2/builder/RequestSizeLimits.java    |  99 +++++++
 .../axis2/builder/XFormURLEncodedBuilder.java      |   9 +-
 .../org/apache/axis2/engine/AxisConfiguration.java |   4 +
 .../builder/MultipartFormDataBuilderTest.java      | 274 +++++++++++++++++++
 .../axis2/builder/RequestSizeLimitsTest.java       | 130 +++++++++
 .../apache/axis2/openapi/OpenApiConfiguration.java |  13 +
 .../apache/axis2/openapi/OpenApiSpecGenerator.java |  61 ++++-
 .../org/apache/axis2/openapi/RequestUrlPolicy.java | 112 ++++++++
 .../org/apache/axis2/openapi/SwaggerUIHandler.java | 118 ++++++++-
 .../apache/axis2/openapi/RequestUrlPolicyTest.java | 103 ++++++++
 .../apache/axis2/openapi/SwaggerUIHandlerTest.java |  57 ++++
 .../apache/axis2/transport/http/HTTPWorker.java    |  10 +
 .../apache/axis2/transport/http/ListingAgent.java  |   8 +
 modules/webapp/conf/axis2.xml                      |  44 ++++
 22 files changed, 1979 insertions(+), 26 deletions(-)

Reply via email to