Skip to content

URIHandler.DEFAULT_HANDLERS as potential security risk #101

@juergen-albert

Description

@juergen-albert

The DEFAULT_HANDLERS are an unmodifiable List, that applies to all ResourceSets created with new ResourceSetIml(). This leads to the behavior, that by default any Proxy with an HTTP URI will result in a Request.

Any chance, that this list can become modifiable, so we can remove the handler, so nobody accidentally creates a new ResourceSet that exabits such behavior? This is an issue, that gets us into trouble with any security audit.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions