Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Sandboxed URL creation to prevent SSRF attacks #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Sandboxed URL creation to prevent SSRF attacks #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions xwiki-commons-core/xwiki-commons-classloader/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,4 +34,16 @@
<modules>
<module>xwiki-commons-classloader-api</module>
</modules>
<dependencyManagement>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<dependencies>
<dependency>
<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
<version>${versions.java-security-toolkit}</version>
</dependency>
</dependencies>
</dependencyManagement>
<properties>
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
</properties>
</project>
4 changes: 4 additions & 0 deletions xwiki-commons-core/xwiki-commons-classloader/xwiki-commons-classloader-api/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,10 @@
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
</dependency>
<dependency>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
</dependency>
</dependencies>
<build>
<plugins>
Expand Down
4 changes: 3 additions & 1 deletion ...lassloader-api/src/main/java/org/xwiki/classloader/internal/ExtendedJarURLConnection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
*/
package org.xwiki.classloader.internal;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.File;
import java.io.FileNotFoundException;
import java.io.IOException;
Expand Down Expand Up @@ -184,7 +186,7 @@ private void parseSpecs(URL url) throws MalformedURLException
}

// This is the main difference with standard JarURLConnection: we use a component to handle the actual file
this.jarFileURL = new URL(null, spec.substring(0, separator++), this.handler);
this.jarFileURL = Urls.create(null, spec.substring(0, separator++), this.handler, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
this.entryName = null;

/* if ! is the last letter of the innerURL, entryName is null */
Expand Down
6 changes: 4 additions & 2 deletions ...sloader-api/src/main/java/org/xwiki/classloader/internal/JarExtendedURLStreamHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@
// In java.net package to be allowed to call URLStreamHandler methods
package org.xwiki.classloader.internal;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.File;
import java.io.IOException;
import java.net.MalformedURLException;
Expand Down Expand Up @@ -108,7 +110,7 @@ protected URLConnection openConnection(URL u) throws IOException
}

// For anything else use standard JAR handler
return new URL(null, spec).openConnection();
return Urls.create(null, spec, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).openConnection();
}

@Override
Expand Down Expand Up @@ -223,7 +225,7 @@ private String parseAbsoluteSpec(String spec) {
// test the inner URL
try {
String innerSpec = spec.substring(0, index - 1);
new URL(innerSpec);
Urls.create(innerSpec, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
} catch (MalformedURLException e) {
throw new NullPointerException("invalid url: " +
spec + " (" + e + ")");
Expand Down
12 changes: 12 additions & 0 deletions xwiki-commons-core/xwiki-commons-crypto/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,4 +69,16 @@
<module>xwiki-commons-crypto-signer</module>
<module>xwiki-commons-crypto-store</module>
</modules>
<dependencyManagement>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<dependencies>
<dependency>
<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
<version>${versions.java-security-toolkit}</version>
</dependency>
</dependencies>
</dependencyManagement>
<properties>
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
</properties>
</project>
4 changes: 4 additions & 0 deletions xwiki-commons-core/xwiki-commons-crypto/xwiki-commons-crypto-pkix/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,5 +57,9 @@
<groupId>com.sun.mail</groupId>
<artifactId>jakarta.mail</artifactId>
</dependency>
<dependency>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
</dependency>
</dependencies>
</project>
4 changes: 3 additions & 1 deletion ...to-pkix/src/main/java/org/xwiki/crypto/pkix/params/x509certificate/extension/X509URI.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
*/
package org.xwiki.crypto.pkix.params.x509certificate.extension;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.net.MalformedURLException;
import java.net.URI;
import java.net.URISyntaxException;
Expand Down Expand Up @@ -60,7 +62,7 @@ public X509URI(String str)
newUri = newUrl.toURI();
} catch (URISyntaxException e) {
try {
newUrl = new URL(str);
newUrl = Urls.create(str, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
newStr = newUrl.toString();
} catch (MalformedURLException e1) {
newStr = str;
Expand Down
12 changes: 12 additions & 0 deletions xwiki-commons-core/xwiki-commons-extension/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,5 +46,17 @@
<module>xwiki-commons-extension-handlers</module>
<module>xwiki-commons-extension-repositories</module>
</modules>
<dependencyManagement>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<dependencies>
<dependency>
<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
<version>${versions.java-security-toolkit}</version>
</dependency>
</dependencies>
</dependencyManagement>
<properties>
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
</properties>
</project>

4 changes: 4 additions & 0 deletions xwiki-commons-core/xwiki-commons-extension/xwiki-commons-extension-api/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,10 @@
<version>${project.version}</version>
<scope>test</scope>
</dependency>
<dependency>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
</dependency>
</dependencies>
<build>
<plugins>
Expand Down
4 changes: 3 additions & 1 deletion ...xwiki-commons-extension-api/src/main/java/org/xwiki/extension/DefaultExtensionAuthor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
*/
package org.xwiki.extension;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.net.MalformedURLException;
import java.net.URL;
import java.util.Objects;
Expand Down Expand Up @@ -79,7 +81,7 @@ public URL getURL()
{
if (this.urlCache == null && this.url != null) {
try {
this.urlCache = new URL(this.url);
this.urlCache = Urls.create(this.url, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
} catch (MalformedURLException e) {
// TODO: Should probably log something
}
Expand Down
4 changes: 3 additions & 1 deletion ...ion/xwiki-commons-extension-api/src/main/java/org/xwiki/extension/internal/PathUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
*/
package org.xwiki.extension.internal;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.JarURLConnection;
Expand Down Expand Up @@ -71,7 +73,7 @@ private static URL fixURL(URL jarURL)
jarURLString = jarURLString.replace(" ", "%20");

try {
return new URL(jarURLString);
return Urls.create(jarURLString, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
} catch (MalformedURLException e) {
// TODO: Log something ?
}
Expand Down
4 changes: 3 additions & 1 deletion ...src/main/java/org/xwiki/extension/repository/internal/URLExtensionPropertySerializer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
*/
package org.xwiki.extension.repository.internal;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.net.URL;

import org.w3c.dom.Element;
Expand All @@ -42,7 +44,7 @@ public URLExtensionPropertySerializer()
public URL toValue(Element element)
{
try {
return new URL(element.getTextContent());
return Urls.create(element.getTextContent(), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
} catch (Exception e) {
// TODO: should maybe log something
return null;
Expand Down
6 changes: 4 additions & 2 deletions ...c/main/java/org/xwiki/extension/repository/internal/core/DefaultCoreExtensionScanner.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
*/
package org.xwiki.extension.repository.internal.core;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.IOException;
import java.io.InputStream;
import java.net.MalformedURLException;
Expand Down Expand Up @@ -264,7 +266,7 @@ private DefaultCoreExtension loadCoreExtensionFromXED(URL jarURL, DefaultCoreExt
// Find XED file URL
URL xedURL;
try {
xedURL = new URL(jarString.substring(0, extIndex) + ".xed");
xedURL = Urls.create(jarString.substring(0, extIndex) + ".xed", Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
} catch (MalformedURLException e) {
// Cannot really happen
return null;
Expand Down Expand Up @@ -371,6 +373,6 @@ private static URL getEnvironmentExtensionURL(URL xedURL) throws MalformedURLExc
List<String> segments = Arrays.asList(xedURL.toString().split(separator));
// Remove the segments corresponding to "/META-INF/extension.xed" at the end of the URL.
List<String> startSegments = segments.subList(0, segments.size() - 2);
return new URL(String.join(separator, startSegments));
return Urls.create(String.join(separator, startSegments), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
}
}
4 changes: 3 additions & 1 deletion ...xwiki-commons-extension-api/src/test/java/org/xwiki/extension/test/ExtensionPackager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
*/
package org.xwiki.extension.test;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
Expand Down Expand Up @@ -171,7 +173,7 @@ public void generateExtension(String classPackageFolder, URL descriptorUrl) thro
try {
// Order files
TreeMap<String, Vfs.File> files = new TreeMap<>();
for (Vfs.File resourceFile : Vfs.fromURL(new URL(descriptorFolderURL)).getFiles()) {
for (Vfs.File resourceFile : Vfs.fromURL(Urls.create(descriptorFolderURL, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS)).getFiles()) {
files.put(resourceFile.getRelativePath(), resourceFile);
}

Expand Down
12 changes: 12 additions & 0 deletions xwiki-commons-core/xwiki-commons-extension/xwiki-commons-extension-repositories/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,5 +37,17 @@
<module>xwiki-commons-extension-repository-xwiki</module>
<module>xwiki-commons-extension-repository-maven-snapshots</module>
</modules>
<dependencyManagement>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<dependencies>
<dependency>
<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
<version>${versions.java-security-toolkit}</version>
</dependency>
</dependencies>
</dependencyManagement>
<properties>
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
</properties>
</project>

4 changes: 4 additions & 0 deletions ...ion/xwiki-commons-extension-repositories/xwiki-commons-extension-repository-maven/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,10 @@
<version>${project.version}</version>
<scope>test</scope>
</dependency>
<dependency>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
</dependency>
</dependencies>
<build>
<plugins>
Expand Down
6 changes: 4 additions & 2 deletions ...en/src/main/java/org/xwiki/extension/repository/maven/internal/MavenExtensionScanner.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
*/
package org.xwiki.extension.repository.maven.internal;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.IOException;
import java.io.InputStream;
import java.net.MalformedURLException;
Expand Down Expand Up @@ -168,10 +170,10 @@ private boolean scan(Map<String, DefaultCoreExtension> extensions, URL jarURL,
try {
if (path.endsWith("/")) {
// It's a folder
descriptorURL = new URL(path + descriptor);
descriptorURL = Urls.create(path + descriptor, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
} else {
// Probably a jar
descriptorURL = new URL("jar:" + jarURL.toExternalForm() + "!/" + descriptor);
descriptorURL = Urls.create("jar:" + jarURL.toExternalForm() + "!/" + descriptor, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
}
} catch (MalformedURLException e) {
// Not supposed to happen (would mean there is a bug in Reflections)
Expand Down
12 changes: 12 additions & 0 deletions xwiki-commons-core/xwiki-commons-filter/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,5 +38,17 @@
<module>xwiki-commons-filter-events</module>
<module>xwiki-commons-filter-streams</module>
</modules>
<dependencyManagement>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<dependencies>
<dependency>
<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
<version>${versions.java-security-toolkit}</version>
</dependency>
</dependencies>
</dependencyManagement>
<properties>
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
</properties>
</project>

4 changes: 4 additions & 0 deletions xwiki-commons-core/xwiki-commons-filter/xwiki-commons-filter-api/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,10 @@
<version>${project.version}</version>
<scope>test</scope>
</dependency>
<dependency>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
</dependency>
</dependencies>
<build>
<plugins>
Expand Down
4 changes: 3 additions & 1 deletion ...-api/src/main/java/org/xwiki/filter/internal/input/DefaultInputSourceReferenceParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
*/
package org.xwiki.filter.internal.input;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.File;
import java.net.URL;

Expand Down Expand Up @@ -68,7 +70,7 @@ public InputSource parse(String reference) throws FilterException

if (prefix.equals("url")) {
try {
inputSource = new DefaultURLInputSource(new URL(value));
inputSource = new DefaultURLInputSource(Urls.create(value, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS));
} catch (Exception e) {
throw new ConversionException("Failed to create input source for URL [" + reference + "]", e);
}
Expand Down
3 changes: 2 additions & 1 deletion xwiki-commons-core/xwiki-commons-legacy/xwiki-commons-legacy-classloader/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,11 +39,12 @@
<dependency>
<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>

Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<version>${versions.java-security-toolkit}</version>
</dependency>
</dependencies>
</dependencyManagement>
<properties>
<versions.java-security-toolkit>1.2.0</versions.java-security-toolkit>
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
</properties>
</project>
14 changes: 14 additions & 0 deletions ...mons-legacy/xwiki-commons-legacy-classloader/xwiki-commons-legacy-classloader-api/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
<description>Legacy module for xwiki-commons-classloader-api</description>
<properties>
<xwiki.jacoco.instructionRatio>0.00</xwiki.jacoco.instructionRatio>
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
</properties>
<dependencies>
<!-- Trigger xwiki-commons-classloader-api (but without xwiki-commons-classloader-api jar itself) -->
Expand Down Expand Up @@ -65,6 +66,10 @@
<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
</dependency>
<dependency>
Copy link
Author

@pixeebot pixeebot bot Aug 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
</dependency>
</dependencies>
<build>
<plugins>
Expand Down Expand Up @@ -128,4 +133,13 @@
</plugin>
</plugins>
</build>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
<version>${versions.java-security-toolkit}</version>
</dependency>
</dependencies>
</dependencyManagement>
</project>
Loading