[CXF-9227] Fix SecurityManager permission regressions introduced in 4.1.7 (#3256)

(cherry picked from commit 316973a)

Author: ffang

core/src/main/java/org/apache/cxf/resource/URIResolver.java

@@ -32,6 +32,8 @@
 import java.nio.file.Files;
 import java.security.AccessController;
 import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
@@ -271,7 +273,16 @@ private static boolean followRedirect(int status) {
 
     private HttpURLConnection createInputStream() throws IOException {
         checkAllowedScheme(url);
-        HttpURLConnection huc = (HttpURLConnection)url.openConnection();
+        // Wrap the network connection in doPrivileged so that callers (including
+        // user deployments) do not need SocketPermission for the target host.
+        final HttpURLConnection huc;
+        try {
+            huc = AccessController.doPrivileged(
+                (PrivilegedExceptionAction<HttpURLConnection>) () ->
+                    (HttpURLConnection)url.openConnection());
+        } catch (PrivilegedActionException e) {
+            throw (IOException) e.getException();
+        }
 
         String host = SystemPropertyAction.getPropertyOrNull("http.proxyHost");
         if (host != null) {

core/src/main/java/org/apache/cxf/ws/addressing/EndpointReferenceUtils.java

@@ -27,6 +27,8 @@
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -199,7 +201,15 @@ public LSInput resolveResource(String type, String namespaceURI, String publicId
                     systemId = publicId;
                 }
                 if (systemId != null) {
-                    InputSource source = resolver.resolve(systemId, baseURI);
+                    // Run inside doPrivileged so that sm.checkPermission() calls
+                    // inside the resolver chain (SecurityActions.fileExists) stop
+                    // at this boundary and check only CXF's own permissions rather
+                    // than walking up through the JAXP schema-validator frames that
+                    // lack CXF-internal permissions.
+                    final String sid = systemId;
+                    final String buri = baseURI;
+                    InputSource source = AccessController.doPrivileged(
+                        (PrivilegedAction<InputSource>) () -> resolver.resolve(sid, buri));
                     if (source != null) {
                         impl = new LSInputImpl();
                         impl.setByteStream(source.getByteStream());

rt/transports/http/src/main/java/org/apache/cxf/transport/http/ProxyFactory.java

@@ -22,6 +22,8 @@
 import java.net.Proxy;
 import java.net.ProxySelector;
 import java.net.URI;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.List;
 import java.util.regex.Pattern;
 
@@ -50,7 +52,8 @@ public Proxy createProxy(HTTPClientPolicy policy, URI currentUrl) {
      * are honoured rather than bypassed.
      */
     private Proxy getSystemProxy(URI uri) {
-        ProxySelector selector = ProxySelector.getDefault();
+        ProxySelector selector = AccessController.doPrivileged(
+            (PrivilegedAction<ProxySelector>) ProxySelector::getDefault);
         if (selector == null) {
             return null;
         }