Skip to content

Restrict URL protocol types loaded by XBeanBrokerFactory#1910

Merged
cshannon merged 2 commits intoapache:mainfrom
cshannon:xbean-validation
Apr 13, 2026
Merged

Restrict URL protocol types loaded by XBeanBrokerFactory#1910
cshannon merged 2 commits intoapache:mainfrom
cshannon:xbean-validation

Conversation

@cshannon
Copy link
Copy Markdown
Contributor

@cshannon cshannon commented Apr 13, 2026 •
edited
Loading

This adds a new system property to control which protocol types are valid for loading resources using the XBeanBrokerFactory. By default only file and classpath resources can be loaded.

The goal of this is to prevent possible future security issues by hardening what is allowed to be loaded by default. There have been a lot of previous CVEs reported that were made possible by allowing remoting loading of Spring contexts (ie using http) so this will help stop any future vulnerabilities from being discovered but just no longer allowing that out of the box.

This PR does the following:

  1. Restrict which URL protocols can be used to load resources by the XBeanBrokerFactory (and vm transport that uses it) with classpath and file allowed by default.
  2. This adds a new property that users can set to control what is allowed: org.apache.activemq.xbean.XBEAN_BROKER_FACTORY_PROTOCOLS
  3. The default is set to classpath,file so we only allow those resources. *can be used to allow all and empty string to allow none.
  4. The default behavior of the order that resources are tried is preserved like before. A URL is always tired first as a file on the file system to see if it is found, then it checks if it's a URI, and lastly falls back to classpath. This still happens assuming the configuration allows it (ie file or classpath could be skipped if either or both are not allowed)
  5. It loads correctly both file or classpath using either the fully qualified prefix or not (just like before)
  6. I added a ton of unit tests, including full code coverage for the Utils class which does all the loading and validation.

Closes #1899

@cshannon
Restrict URL protocol types loaded by XBeanBrokerFactory
ab6c5ad 
This adds a new system property to control which protocol types are
valid for loading resources using the XBeanBrokerFactory. By default
only file and classpath resources can be loaded.

The goal of this is to prevent possible future security issues by
hardening what is allowed to be loaded by default.
@cshannon cshannon requested review from hogstrom, jbonofre, mattrpav and tabish121 and removed request for hogstrom April 13, 2026 13:26
@cshannon cshannon mentioned this pull request Apr 13, 2026
Closed
mattrpav
mattrpav previously approved these changes Apr 13, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@mattrpav mattrpav left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

jbonofre
jbonofre previously approved these changes Apr 13, 2026
View reviewed changes
Comment thread activemq-spring/src/main/java/org/apache/activemq/xbean/XBeanBrokerFactory.java Outdated
import org.apache.activemq.broker.BrokerService;
import org.apache.activemq.spring.SpringBrokerContext;
import org.apache.activemq.spring.Utils;
import org.apache.activemq.transport.stomp.FrameTranslator;
Copy link
Copy Markdown
Member

@jbonofre jbonofre Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems these imports are not actually used in the factory.

Maybe coming from previous dev ?

Copy link
Copy Markdown
Contributor Author

@cshannon cshannon Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably, we really need a plugin to check imports (I've mentioned this before), it's too easy for imports to leak in by mistake when making a lot of changes and refactoring.

Comment thread activemq-spring/src/main/java/org/apache/activemq/xbean/XBeanBrokerFactory.java Outdated
public static final String XBEAN_BROKER_FACTORY_PROTOCOLS_PROP =
"org.apache.activemq.xbean.XBEAN_BROKER_FACTORY_PROTOCOLS";
public static final String DEFAULT_ALLOWED_PROTOCOLS =
String.join(",", Set.of(Utils.FILE_PROTOCOL, Utils.CLASSPATH_PROTOCOL));
Copy link
Copy Markdown
Member

@jbonofre jbonofre Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's no guarantee of order here: it could be file,classpath or classpath,file.

Why not just using a simple Utils.FILE_PROTOCOL + "," + Utils.CLASSPATH_PROTOCOL.

Copy link
Copy Markdown
Contributor Author

@cshannon cshannon Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Order shouldn't matter but doing that is fine too and easier to read

@cshannon cshannon dismissed stale reviews from jbonofre and mattrpav via ddcb4f8 April 13, 2026 17:10
@cshannon cshannon merged commit 85fa7bb into apache:main Apr 13, 2026
9 checks passed
@github-project-automation github-project-automation Bot moved this from Backlog to Done in Apache ActiveMQ v6.3.0 Apr 13, 2026
@cshannon cshannon deleted the xbean-validation branch April 13, 2026 17:13
cshannon added a commit to cshannon/activemq that referenced this pull request Apr 13, 2026
@cshannon
Restrict URL protocol types loaded by XBeanBrokerFactory (apache#1910)
13221c7 
This adds a new system property to control which protocol types are
valid for loading resources using the XBeanBrokerFactory. By default
only file and classpath resources can be loaded.

The goal of this is to prevent possible future security issues by
hardening what is allowed to be loaded by default.

(cherry picked from commit 85fa7bb)
cshannon added a commit to cshannon/activemq that referenced this pull request Apr 13, 2026
@cshannon
Restrict URL protocol types loaded by XBeanBrokerFactory (apache#1910)
ec43999 
This adds a new system property to control which protocol types are
valid for loading resources using the XBeanBrokerFactory. By default
only file and classpath resources can be loaded.

The goal of this is to prevent possible future security issues by
hardening what is allowed to be loaded by default.

(cherry picked from commit 85fa7bb)
cshannon added a commit that referenced this pull request Apr 13, 2026
@cshannon
Restrict URL protocol types loaded by XBeanBrokerFactory (#1910) (#1916)
e1802c8 
This adds a new system property to control which protocol types are
valid for loading resources using the XBeanBrokerFactory. By default
only file and classpath resources can be loaded.

The goal of this is to prevent possible future security issues by
hardening what is allowed to be loaded by default.

(cherry picked from commit 85fa7bb)
cshannon added a commit that referenced this pull request Apr 13, 2026
@cshannon
Restrict URL protocol types loaded by XBeanBrokerFactory (#1910) (#1915)
d88c0ed 
This adds a new system property to control which protocol types are
valid for loading resources using the XBeanBrokerFactory. By default
only file and classpath resources can be loaded.

The goal of this is to prevent possible future security issues by
hardening what is allowed to be loaded by default.

(cherry picked from commit 85fa7bb)
cshannon added a commit that referenced this pull request Apr 13, 2026
@cshannon
Revert "Restrict URL protocol types loaded by XBeanBrokerFactory (#1910…
ac4adcf 
…) (#1915)"

This reverts commit d88c0ed.
pburgess147 pushed a commit to peersoftware/activemq that referenced this pull request Apr 17, 2026
@cshannon @pburgess147
Restrict URL protocol types loaded by XBeanBrokerFactory (apache#1910) (
e741924 
apache#1915)

This adds a new system property to control which protocol types are
valid for loading resources using the XBeanBrokerFactory. By default
only file and classpath resources can be loaded.

The goal of this is to prevent possible future security issues by
hardening what is allowed to be loaded by default.

(cherry picked from commit 85fa7bb)
@cshannon cshannon mentioned this pull request Apr 21, 2026
Merged
cshannon added a commit that referenced this pull request Apr 21, 2026
@cshannon
Add remote file filtering for XBeanBrokerFactory (#1950)
87f1880 
This expands on the previous work in #1910 to add treat remote files as
a separate protocol category that can be controlled independently of
regular files when loading resources. By default remote files will be
disabled.

Follow on to #1910
This was referenced Apr 21, 2026
Merged
Merged
jbonofre pushed a commit that referenced this pull request Apr 21, 2026
@cshannon
Add remote file filtering for XBeanBrokerFactory (#1950) (#1955)
854ef64 
This expands on the previous work in #1910 to add treat remote files as
a separate protocol category that can be controlled independently of
regular files when loading resources. By default remote files will be
disabled.

Follow on to #1910

(cherry picked from commit 87f1880)
jbonofre pushed a commit that referenced this pull request Apr 21, 2026
@cshannon
Add remote file filtering for XBeanBrokerFactory (#1950) (#1954)
881ce9d 
This expands on the previous work in #1910 to add treat remote files as
a separate protocol category that can be controlled independently of
regular files when loading resources. By default remote files will be
disabled.

Follow on to #1910

(cherry picked from commit 87f1880)
jgallimore added a commit to tomitribe/activemq that referenced this pull request Apr 24, 2026
@jgallimore
Restrict URL protocol types loaded by XBeanBrokerFactory (apache#1910) (
041dec4 
apache#1916)

Cherry-picked from 5.19.x: e1802c8
jgallimore added a commit to tomitribe/activemq that referenced this pull request Apr 24, 2026
@jgallimore
Restrict URL protocol types loaded by XBeanBrokerFactory (apache#1910) (
eeeb543 
apache#1916)

Cherry-picked from 5.19.x: e1802c8
jgallimore added a commit to tomitribe/activemq that referenced this pull request Apr 24, 2026
@jgallimore
Restrict URL protocol types loaded by XBeanBrokerFactory (apache#1910) (
1d791ae 
apache#1915)

Cherry-picked from 6.2.x: d88c0ed
jgallimore added a commit to tomitribe/activemq that referenced this pull request Apr 24, 2026
@jgallimore
Restrict URL protocol types loaded by XBeanBrokerFactory (apache#1910) (
781c682 
apache#1915)

Cherry-picked from 6.2.x: d88c0ed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jbonofre jbonofre jbonofre approved these changes

@mattrpav mattrpav mattrpav left review comments

@tabish121 tabish121 Awaiting requested review from tabish121

Assignees

No one assigned

Labels

None yet

Projects

Apache ActiveMQ v6.3.0
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Review options for ConnectionFactory configuration for allow/deny list of protocol schemes

3 participants

@cshannon @jbonofre @mattrpav