[XERCESC-2254] Some NetAccessors attempt to resolve relative URLs

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.2.0, 3.1.3, 3.1.4, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5
• Fix Version/s: 3.3.0
• Component/s: NetAccessors
• Assignee: Scott Cantor
• Reporter: Scott Cantor
• Created: 26/Sep/24 14:45
• Updated: 14/Oct/24 18:37
• Resolved: 26/Sep/24 14:47

Description

It was noted that the NetAccessors don't have any guard against being handed a relative URL, which is not a sensible thing for them to be trying to resolve. Further, at least one of the implemented NetAccessors can do protocol inference for scheme-less URLs, making them unsafe to use.

All applications should have an entity/resource resolver guarding URLs anyway, but we should harden the code to just prevent it from happening by the supplied implementations.

Thanks to Wild Pointer / Barak Sternberg for finding this issue.