From a4e4cbd177ca54ec591cf4fb5931e65b8d1177e6 Mon Sep 17 00:00:00 2001
From: Colm O hEigeartaigh <coheigea@apache.org>
Date: Tue, 7 Jul 2026 11:23:46 +0100
Subject: [PATCH] Plug URIResolver into AttachmentUtil

---
 .../org/apache/cxf/attachment/AttachmentUtil.java    |  7 ++++++-
 .../cxf/attachment/AttachmentDeserializerTest.java   | 12 ++++++++++++
 .../apache/cxf/aegis/type/mtom/AttachmentUtil.java   |  8 +++++---
 3 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
index 79f34d81101..0917d1d72a4 100644
--- a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
+++ b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
@@ -63,6 +63,7 @@
 import org.apache.cxf.message.Attachment;
 import org.apache.cxf.message.Message;
 import org.apache.cxf.message.MessageUtils;
+import org.apache.cxf.resource.URIResolver;
 
 public final class AttachmentUtil {
     // The default values for {@link AttachmentDataSource} content type in case when
@@ -593,12 +594,16 @@ public static DataSource getAttachmentDataSource(String contentId, Collection<At
                     final boolean followUrls = Boolean.valueOf(SystemPropertyAction
                         .getProperty(ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY, "false"));
                     if (followUrls) {
-                        return new URLDataSource(new URL(contentId));
+                        final URL remoteUrl = new URL(contentId);
+                        URIResolver.checkAllowedScheme(remoteUrl);
+                        return new URLDataSource(remoteUrl);
                     } else {
                         return loadDataSource(contentId, atts);
                     }
                 } catch (MalformedURLException e) {
                     throw new Fault(e);
+                } catch (IOException e) {
+                    throw new Fault(e);
                 }
             }
         } else {
diff --git a/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java b/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java
index 1d6e2dd756e..857704c7878 100644
--- a/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java
+++ b/core/src/test/java/org/apache/cxf/attachment/AttachmentDeserializerTest.java
@@ -43,6 +43,7 @@
 import jakarta.activation.DataSource;
 import jakarta.activation.URLDataSource;
 import org.apache.cxf.helpers.IOUtils;
+import org.apache.cxf.interceptor.Fault;
 import org.apache.cxf.io.CacheSizeExceededException;
 import org.apache.cxf.message.Attachment;
 import org.apache.cxf.message.Exchange;
@@ -942,4 +943,15 @@ public void testCXF8706followUrl() {
             System.clearProperty(AttachmentUtil.ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY);
         }
     }
+
+    @Test
+    public void testCXF8706followUrlRejectsDisallowedScheme() {
+        System.setProperty(AttachmentUtil.ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY, "true");
+        try {
+            assertThrows(Fault.class, () -> AttachmentUtil
+                .getAttachmentDataSource("cid:gopher://image.com/1.gif", Collections.emptyList()));
+        } finally {
+            System.clearProperty(AttachmentUtil.ATTACHMENT_XOP_FOLLOW_URLS_PROPERTY);
+        }
+    }
 }
diff --git a/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java b/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java
index fbc7b21cf3b..588b4df82e2 100644
--- a/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java
+++ b/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/mtom/AttachmentUtil.java
@@ -18,7 +18,6 @@
  */
 package org.apache.cxf.aegis.type.mtom;
 
-import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
@@ -32,6 +31,7 @@
 import org.apache.cxf.attachment.AttachmentImpl;
 import org.apache.cxf.common.util.SystemPropertyAction;
 import org.apache.cxf.message.Attachment;
+import org.apache.cxf.resource.URIResolver;
 
 public final class AttachmentUtil {
     // The xop:include "href" attribute (https://www.w3.org/TR/xop10/#xop_href) may include 
@@ -78,9 +78,11 @@ public static Attachment getAttachment(String id, Collection<Attachment> attachm
         if (followUrls) {
             // Try loading the URL remotely
             try {
-                URLDataSource source = new URLDataSource(new URL(id));
+                final URL remoteUrl = new URL(id);
+                URIResolver.checkAllowedScheme(remoteUrl);
+                URLDataSource source = new URLDataSource(remoteUrl);
                 return new AttachmentImpl(id, new DataHandler(source));
-            } catch (MalformedURLException e) {
+            } catch (java.io.IOException e) {
                 return null;
             }
         }