This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
from fd9364499c Merge pull request #1258 from
apache/dependabot/maven/org.apache.neethi-neethi-3.2.3
new 173bad1882 Document CVE-2026-66713 for the removed clustering
deserialization issue
new 1671a68660 Harden five anonymous-reachable surfaces reported privately
on 2026-07-30
new 2b98e5a31c Delete multipart temporary files instead of accumulating
them
new 1b5b2fcac5 Do not restrict WS-Addressing reply endpoints to HTTP
new f98c5d4943 Mirror the new tuning parameters into the webapp axis2.xml
new 9ad5b471ac Only refuse never-legitimate reply destinations by default
new cfbaf6a648 Cover the attack path an inbound wsa:ReplyTo actually takes
new 8c783edfdb Harden five anonymous-reachable surfaces from a private
security report
new bb87bdec6b Merge remote-tracking branch 'origin/master'
new 0e256fd0c5 Bound the response-endpoint name lookup
new cbcccb33bc Bound and shut down the response-endpoint resolver pool
new a483b5cdfd Publish a relative OpenAPI server URL instead of following
the Host
new 1b6856b4d7 Refuse decoupled WS-Addressing responses by default
new 52c7ba310f Also gate the response endpoint where the transport is
acquired
new 1d325f4deb Permit only https as a reply scheme unless told otherwise
new 75191f7752 Do not follow redirects when sending a decoupled response
new 5ec4d1525e Drop third-party references from test documentation
The 17 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
SECURITY.md | 10 +-
.../handlers/addressing/AddressingInHandler.java | 24 ++
.../addressing/AddressingFinalInHandlerTest.java | 9 +
...ddressingResponseEndpointPolicyHandlerTest.java | 176 ++++++++
modules/integration/pom.xml | 60 +++
.../test-resources/mtom/MTOM-enabled-axis2.xml | 5 +
.../mtom/MTOM-fileCache-enabled-axis2.xml | 5 +
modules/kernel/conf/axis2.xml | 61 +++
.../AddressingResponseEndpointPolicy.java | 455 +++++++++++++++++++++
.../apache/axis2/builder/BoundedInputStream.java | 90 ++++
.../axis2/builder/MultipartFormDataBuilder.java | 63 ++-
.../axis2/builder/MultipartTempFileTracker.java | 93 +++++
.../apache/axis2/builder/RequestSizeLimits.java | 99 +++++
.../axis2/builder/XFormURLEncodedBuilder.java | 9 +-
.../org/apache/axis2/engine/AxisConfiguration.java | 6 +
.../apache/axis2/util/MessageContextBuilder.java | 15 +
.../AddressingResponseEndpointPolicyTest.java | 284 +++++++++++++
.../builder/MultipartFormDataBuilderTest.java | 274 +++++++++++++
.../axis2/builder/RequestSizeLimitsTest.java | 130 ++++++
.../apache/axis2/openapi/OpenApiConfiguration.java | 13 +
.../apache/axis2/openapi/OpenApiSpecGenerator.java | 83 ++--
.../org/apache/axis2/openapi/RequestUrlPolicy.java | 112 +++++
.../org/apache/axis2/openapi/SwaggerUIHandler.java | 118 +++++-
.../axis2/openapi/Http2OpenApiBasicTest.java | 20 +-
.../axis2/openapi/Http2OpenApiIntegrationTest.java | 20 +-
.../axis2/openapi/OpenApiSpecGeneratorTest.java | 46 ++-
.../apache/axis2/openapi/RequestUrlPolicyTest.java | 103 +++++
.../apache/axis2/openapi/SwaggerUIHandlerTest.java | 57 +++
.../apache/axis2/transport/http/HTTPWorker.java | 10 +
.../apache/axis2/transport/http/ListingAgent.java | 8 +
.../http/impl/httpclient5/RequestImpl.java | 15 +
.../httpclient5/DecoupledResponseRedirectTest.java | 148 +++++++
modules/webapp/conf/axis2.xml | 61 +++
33 files changed, 2594 insertions(+), 88 deletions(-)
create mode 100644
modules/addressing/test/org/apache/axis2/handlers/addressing/AddressingResponseEndpointPolicyHandlerTest.java
create mode 100644
modules/kernel/src/org/apache/axis2/addressing/AddressingResponseEndpointPolicy.java
create mode 100644
modules/kernel/src/org/apache/axis2/builder/BoundedInputStream.java
create mode 100644
modules/kernel/src/org/apache/axis2/builder/MultipartTempFileTracker.java
create mode 100644
modules/kernel/src/org/apache/axis2/builder/RequestSizeLimits.java
create mode 100644
modules/kernel/test/org/apache/axis2/addressing/AddressingResponseEndpointPolicyTest.java
create mode 100644
modules/kernel/test/org/apache/axis2/builder/MultipartFormDataBuilderTest.java
create mode 100644
modules/kernel/test/org/apache/axis2/builder/RequestSizeLimitsTest.java
create mode 100644
modules/openapi/src/main/java/org/apache/axis2/openapi/RequestUrlPolicy.java
create mode 100644
modules/openapi/src/test/java/org/apache/axis2/openapi/RequestUrlPolicyTest.java
create mode 100644
modules/transport/http/src/test/java/org/apache/axis2/transport/http/impl/httpclient5/DecoupledResponseRedirectTest.java
