This is an automated email from the ASF dual-hosted git repository. robertlazarski pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit 8c783edfdbcd5490a0eb2bedbc3c6a797239b767 Merge: 173bad1882 cfbaf6a648 Author: Robert Lazarski <[email protected]> AuthorDate: Tue Aug 4 08:27:21 2026 -1000 Harden five anonymous-reachable surfaces from a private security report Reported privately via [email protected] on 2026-07-30 against 54de37f455. All five reproduce; four are fixed here, one (F3) is hardened with an opt-in rather than treated as a vulnerability. F1 CWE-918 WS-Addressing ReplyTo/FaultTo drive a server-initiated connection to a caller-chosen address. Screened in AddressingInHandler, at the inbound trust boundary, rather than in the transport sender, which also carries legitimate client calls. Link-local, wildcard and multicast refused always; loopback and private ranges behind blockPrivateNetworkResponseEndpoints. F2 CWE-79 The Host reached an inline script unescaped in the Swagger UI page. URI.create did not neutralise it. Host validated, output encoded for the script context, inline block nonced under a CSP. F3 CWE-644 servers[].url followed the request Host. Added openapi.serverBaseUrl to pin it; the request-derived default still follows the Host, as it does in comparable OpenAPI implementations. F4 CWE-770 The multipart and form-urlencoded builders read the transport stream directly, so the container's post limit never applied. Both bounded, configurable per service. Multipart temp files are now deleted rather than accumulating. F5 CWE-862 The .xsd/.wsdl file routes, HTTPWorker's named-WSDL route and the whole OpenAPI/MCP generator ignored exposeServiceMetadata. CVEs to be requested after release, per the process followed for CVE-2026-66713. .../handlers/addressing/AddressingInHandler.java | 23 ++ .../addressing/ResponseEndpointPolicy.java | 291 +++++++++++++++++++++ .../ResponseEndpointPolicyHandlerTest.java | 146 +++++++++++ .../addressing/ResponseEndpointPolicyTest.java | 213 +++++++++++++++ modules/kernel/conf/axis2.xml | 44 ++++ .../apache/axis2/builder/BoundedInputStream.java | 90 +++++++ .../axis2/builder/MultipartFormDataBuilder.java | 63 ++++- .../axis2/builder/MultipartTempFileTracker.java | 93 +++++++ .../apache/axis2/builder/RequestSizeLimits.java | 99 +++++++ .../axis2/builder/XFormURLEncodedBuilder.java | 9 +- .../org/apache/axis2/engine/AxisConfiguration.java | 4 + .../builder/MultipartFormDataBuilderTest.java | 274 +++++++++++++++++++ .../axis2/builder/RequestSizeLimitsTest.java | 130 +++++++++ .../apache/axis2/openapi/OpenApiConfiguration.java | 13 + .../apache/axis2/openapi/OpenApiSpecGenerator.java | 61 ++++- .../org/apache/axis2/openapi/RequestUrlPolicy.java | 112 ++++++++ .../org/apache/axis2/openapi/SwaggerUIHandler.java | 118 ++++++++- .../apache/axis2/openapi/RequestUrlPolicyTest.java | 103 ++++++++ .../apache/axis2/openapi/SwaggerUIHandlerTest.java | 57 ++++ .../apache/axis2/transport/http/HTTPWorker.java | 10 + .../apache/axis2/transport/http/ListingAgent.java | 8 + modules/webapp/conf/axis2.xml | 44 ++++ 22 files changed, 1979 insertions(+), 26 deletions(-)
