Plug URIResolver into StaxUtils (#3293)

(cherry picked from commit 2f715e9)

Author: coheigea

core/src/main/java/org/apache/cxf/staxutils/StaxUtils.java

@@ -93,6 +93,7 @@
 import org.apache.cxf.helpers.CastUtils;
 import org.apache.cxf.helpers.DOMUtils;
 import org.apache.cxf.message.Message;
+import org.apache.cxf.resource.URIResolver;
 
 public final class StaxUtils {
     // System properties for defaults, but also contextual properties usable
@@ -1693,6 +1694,7 @@ public static XMLStreamReader createXMLStreamReader(InputSource src) {
         } else {
             try {
                 final URL url = new URL(sysId);
+                URIResolver.checkAllowedScheme(url);
                 final InputStream is = url.openStream();
                 final StreamSource ss = new StreamSource(is, sysId);
                 ss.setPublicId(pubId);

core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java

@@ -72,6 +72,19 @@ public void testFactoryCreation() {
         assertNotNull(reader);
     }
 
+    @Test
+    public void testCreateXMLStreamReaderInputSourceHonorsAllowedSchemes() throws Exception {
+        InputSource source = new InputSource();
+        source.setSystemId("ftp://127.0.0.1/test.xml");
+
+        try {
+            StaxUtils.createXMLStreamReader(source);
+            fail("Failure expected on disallowed scheme");
+        } catch (IllegalArgumentException ex) {
+            assertEquals("InputSource must have a ByteStream or CharacterStream", ex.getMessage());
+        }
+    }
+
     private InputStream getTestStream(String resource) {
         return getClass().getResourceAsStream(resource);
     }