tomitribe
diff --git a/‎activemq-spring/src/main/java/org/apache/activemq/spring/Utils.java‎
Lines changed: 41 additions & 9 deletions b/‎activemq-spring/src/main/java/org/apache/activemq/spring/Utils.java‎
Lines changed: 41 additions & 9 deletions
@@ -32,6 +32,9 @@ public class Utils {
 
     public static final String FILE_PROTOCOL = "file";
     public static final String CLASSPATH_PROTOCOL = "classpath";
+    // Special marker to indicate we want to allow remote files such as
+    // Windows UNC, etc
+    public static final String REMOTE_FILE_PROTOCOL = "remote-" + FILE_PROTOCOL;
 
     public static Resource resourceFromString(String uri) throws MalformedURLException {
         // default allows all
@@ -49,7 +52,7 @@ public static Resource resourceFromString(String uri, Set<String> allowedProtoco
         // First, just try and load a local file (if it exists) and if "file"
         // as part of the allow list. This preserves previous behavior of
         // always optimistically trying a local file first.
-        if (isAllowFile(allowedProtocols) && new File(uri).exists()) {
+        if (isAllowFile(allowedProtocols, uri) && new File(uri).exists()) {
             resource = new FileSystemResource(uri);
         // If file isn't allowed, or if the file can't be found then check
         // if the string is a valid URL. If it's valid, then we need
@@ -71,28 +74,57 @@ public static Resource resourceFromString(String uri, Set<String> allowedProtoco
         // Catch all fail-safe if nothing else matches. This could happen if file is allowed
         // but not classpath but the file doesn't exist
         } else {
-            throw new IllegalArgumentException("URL [" + uri + "] can't be found or is not allowed"
-                    + " for loading resources");
+            throw new IllegalArgumentException("URL [" + uri + "] can't be found or the protocol"
+                    + " is not allowed for loading resources");
         }
         return resource;
     }
 
-    static boolean isAllowFile(Set<String> allowedProtocols) {
-        return allowedProtocols == null || allowedProtocols.contains(FILE_PROTOCOL);
+    // These method treats local files and remote files (that are pre-fixed
+    // with two forward/backward slashes) differently
+    static boolean isAllowFile(Set<String> allowedProtocols, String uri) {
+        if (allowedProtocols == null) {
+            return true;
+        }
+        return isUnqualifiedRemoteFile(uri) ? allowedProtocols.contains(REMOTE_FILE_PROTOCOL) :
+                allowedProtocols.contains(FILE_PROTOCOL);
     }
 
     static boolean isAllowClasspath(Set<String> allowedProtocols) {
         return allowedProtocols == null || allowedProtocols.contains(CLASSPATH_PROTOCOL);
     }
 
-    private static void validateUrlAllowed(String uriString, Set<String> allowedProtocols)
+    static void validateUrlAllowed(String uriString, Set<String> allowedProtocols)
             throws URISyntaxException {
         // Use new URI() to get the scheme
         // This is important because ResourceUtils.getURL() actually searches
         // the classpath which we don't want to do if not allowed
-        if (allowedProtocols != null && !allowedProtocols.contains(new URI(uriString).getScheme())) {
-            throw new IllegalArgumentException("URL [" + uriString +
-                    "] does not use an allowed protocol for loading URL resources");
+        if (allowedProtocols != null) {
+            final String detectedProtocol = getProtocolFromScheme(uriString);
+            if (detectedProtocol == null) {
+                throw new IllegalArgumentException("Could not detect protocol in given URI [" + uriString + "]");
+            }
+            if (!allowedProtocols.contains(detectedProtocol)){
+                throw new IllegalArgumentException("URL [" + uriString +
+                        "] uses protocol '" + detectedProtocol + "' which is not allowed "
+                        + "for loading URL resources");
+            }
         }
     }
+
+    // If this is a qualified remote file then we return a special marker
+    // so that we know this is trying to access a remote resource as that will be
+    // validated differently
+    private static String getProtocolFromScheme(String uriString) throws URISyntaxException {
+        return isQualifiedRemoteFile(uriString) ? REMOTE_FILE_PROTOCOL :
+                new URI(uriString).getScheme();
+    }
+
+    private static boolean isUnqualifiedRemoteFile(String uri) {
+        return uri.startsWith("//") || uri.startsWith("\\\\");
+    }
+
+    private static boolean isQualifiedRemoteFile(String uri) {
+        return uri.startsWith(FILE_PROTOCOL + "://") ||  uri.startsWith(FILE_PROTOCOL + ":\\\\");
+    }
 }