Repository navigation
ACOMMONS-153 Add jabber.org and apache.org XML feature URLs as safe cleartext identifiers - #511
Conversation
…tifiers CleartextProtocolFilter now recognises a new category of well-known identifier URLs: specific http:// URLs (or URL prefixes) that are opaque protocol/feature identifiers rather than real network endpoints, on hosts that also serve ordinary content: - http://jabber.org/protocol/* (XMPP protocol namespaces) - http://apache.org/xml/features/nonvalidating/load-dtd-grammar - http://apache.org/xml/features/nonvalidating/load-external-dtd (Xerces/JAXP XML parser features to disable DTD loading) Unlike the existing namespace-URI-authority list, these are matched on host + path (not host alone), since jabber.org and apache.org serve ordinary content outside these specific paths.
hashicorp-vault-sonar-prod
Bot
changed the title
This comment has been minimized.
This comment has been minimized.
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
- SAFE_URL_PATH_PREFIXES now matches the whole apache.org/xml/features/
prefix instead of only the two DTD flags, matching the javadoc and
covering other real Xerces feature flags used in this repo (e.g.
xml-parsing's dom/create-entity-ref-nodes).
- isSafeWithoutTls(String)'s lenient fallback (used when strict URI
parsing fails on templated input like ${node}) now also checks
isKnownIdentifierUrl, so templated jabber.org/apache.org identifier
URLs are recognised as safe just like well-formed ones.
Code Review ✅ Approved 2 resolved / 2 findingsAdds ✅ 2 resolved✅ Quality: Javadoc promises all apache.org/xml/features/ flags; regex allows 2
✅ Edge Case: Lenient fallback path ignores the new host+path identifier check
OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
path is never null: URI.getRawPath() is non-null whenever getHost() is non-null (both call sites only invoke this after a host != null check), and the lenient-fallback caller derives path via String.split(), which never returns null.
|
Part of
What
CleartextProtocolFilternow recognises a new category of well-known identifier URLs: specifichttp://URLs (or URL prefixes) that are opaque protocol/feature identifiers rather than real network endpoints, on hosts that also serve ordinary content:http://jabber.org/protocol/*— XMPP protocol namespaces (XEPs)http://apache.org/xml/features/nonvalidating/load-dtd-grammarhttp://apache.org/xml/features/nonvalidating/load-external-dtd(Xerces/JAXP XML parser features to disable DTD loading)
Why
These are used as opaque literal identifiers (XML namespace URIs / XML parser feature-flag URIs) in source code, never as actual network requests, so flagging them as insecure cleartext protocol usage is a false positive.
How
Unlike the existing
NAMESPACE_URI_AUTHORITIESlist (matched on host only),jabber.organdapache.orgalso serve ordinary content outside these specific paths, so a newSAFE_URL_PATH_PREFIXESpattern matches on host + path instead. Added positive and boundary-negative test cases (bare host, near-miss suffix, lookalike host) toCleartextProtocolFilterTest.Testing
mvn -pl commons -am test -Dtest=CleartextProtocolFilterTest→ 214 tests, 0 failures.