[CXF-9227] Fix SecurityManager permission regressions introduced in 4.1.7

Author: ffang

core/src/main/java/org/apache/cxf/resource/SecurityActions.java

@@ -33,9 +33,14 @@ static boolean fileExists(final File file, Permission permission) {
         if (sm == null) {
             return file.exists();
         }
-        sm.checkPermission(permission);
+        // Move the permission check inside doPrivileged so the stack walk stops
+        // at the doPrivileged boundary.  Checking outside doPrivileged walks all
+        // the way up to user-deployment code, which must not be required to hold
+        // a CXF-internal permission.  Inside doPrivileged only CXF's own privilege
+        // context is checked, preserving the confused-deputy guard.
         return AccessController.doPrivileged(new PrivilegedAction<Boolean>() {
             public Boolean run() {
+                sm.checkPermission(permission);
                 return file.exists();
             }
         });

core/src/main/java/org/apache/cxf/resource/URIResolver.java

@@ -32,6 +32,8 @@
 import java.nio.file.Files;
 import java.security.AccessController;
 import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
@@ -271,7 +273,16 @@ private static boolean followRedirect(int status) {
 
     private HttpURLConnection createInputStream() throws IOException {
         checkAllowedScheme(url);
-        HttpURLConnection huc = (HttpURLConnection)url.openConnection();
+        // Wrap the network connection in doPrivileged so that callers (including
+        // user deployments) do not need SocketPermission for the target host.
+        final HttpURLConnection huc;
+        try {
+            huc = AccessController.doPrivileged(
+                (PrivilegedExceptionAction<HttpURLConnection>) () ->
+                    (HttpURLConnection)url.openConnection());
+        } catch (PrivilegedActionException e) {
+            throw (IOException) e.getException();
+        }
 
         String host = SystemPropertyAction.getPropertyOrNull("http.proxyHost");
         if (host != null) {

rt/transports/http/src/main/java/org/apache/cxf/transport/http/ProxyFactory.java

@@ -22,6 +22,8 @@
 import java.net.Proxy;
 import java.net.ProxySelector;
 import java.net.URI;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.List;
 import java.util.regex.Pattern;
 
@@ -50,7 +52,8 @@ public Proxy createProxy(HTTPClientPolicy policy, URI currentUrl) {
      * are honoured rather than bypassed.
      */
     private Proxy getSystemProxy(URI uri) {
-        ProxySelector selector = ProxySelector.getDefault();
+        ProxySelector selector = AccessController.doPrivileged(
+            (PrivilegedAction<ProxySelector>) ProxySelector::getDefault);
         if (selector == null) {
             return null;
         }