)]}'
{
  "commit": "41f3b4e8d04e310ca81f86b92630ab2c11d608bd",
  "tree": "46989991c9c0dbfebb3dad6bb7fc901e8bc58784",
  "parents": [
    "f19d6dfae6c1a4be379a5693d9ef3bdb6b959630"
  ],
  "author": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Sun Jul 12 06:08:36 2026 -1000"
  },
  "committer": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Sun Jul 12 06:08:36 2026 -1000"
  },
  "message": "Prevent arbitrary class instantiation from SOAP fault exceptionName\n\nAn inbound SOAP \u003cFault\u003e whose \u003cdetail\u003e carries an \u003cexceptionName\u003e element\ncaused the fault deserializer to load the named class and invoke its\nconstructor with attacker-controlled data before any type check, running\nthe resulting ClassCastException into a silent catch. With a suitable\ngadget on the classpath (e.g. Spring\u0027s ClassPathXmlApplicationContext,\nthe CVE-2023-46604 gadget) this is an unauthenticated remote\nclass-instantiation / RCE, reachable pre-authentication because the\nengine force-parses the request body during service dispatch.\n\nHarden the fault path:\n- SOAPFaultDetailsBuilder.setValue loads the \u003cexceptionName\u003e class without\n  initializing it (no static initializer runs) and only accepts it if it\n  is an org.apache.axis.AxisFault subtype.\n- SOAPFaultBuilder.createFault gates the reflective constructor branch on\n  AxisFault assignability, so a non-fault class is never constructed.\n- ClassUtils.forName now honors a non-initializing load; the existing\n  three-arg overload previously ignored its init flag (all callers passed\n  true, so behavior is unchanged for them).\n\nLegitimate custom-fault deserialization (real AxisFault subtypes) still\nworks. Adds a regression test that fails against the vulnerable code.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "35666db978faef76d11bc2739aca7c433b72c4a5",
      "old_mode": 33188,
      "old_path": "axis-rt-core/src/main/java/org/apache/axis/message/SOAPFaultBuilder.java",
      "new_id": "dff520c1c8aead5287a7daf35a57ba6e994cbcd4",
      "new_mode": 33188,
      "new_path": "axis-rt-core/src/main/java/org/apache/axis/message/SOAPFaultBuilder.java"
    },
    {
      "type": "modify",
      "old_id": "ff8b56c197deef8ceefdf79f0543cd1b92968225",
      "old_mode": 33188,
      "old_path": "axis-rt-core/src/main/java/org/apache/axis/message/SOAPFaultDetailsBuilder.java",
      "new_id": "f564d95a1d92f00f184933204ceb99f87c2fb6f0",
      "new_mode": 33188,
      "new_path": "axis-rt-core/src/main/java/org/apache/axis/message/SOAPFaultDetailsBuilder.java"
    },
    {
      "type": "modify",
      "old_id": "d0ae7c1ad14ebfbf0f47500faa09d92453b27481",
      "old_mode": 33188,
      "old_path": "axis-rt-core/src/main/java/org/apache/axis/utils/ClassUtils.java",
      "new_id": "62e1301a4b94919e0fac9cbe3f89c5b8fc0c8168",
      "new_mode": 33188,
      "new_path": "axis-rt-core/src/main/java/org/apache/axis/utils/ClassUtils.java"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "1667733aa508ac5f04bc07555c559df25bd66931",
      "new_mode": 33188,
      "new_path": "axis-rt-core/src/test/java/test/faults/FaultGadgetProbe.java"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "6ac1359d67646df30ffc1cb78dcfaa3487939f6a",
      "new_mode": 33188,
      "new_path": "axis-rt-core/src/test/java/test/faults/FaultGadgetState.java"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "251ecb45c1694e8eda70568d084b18ffc727ee5d",
      "new_mode": 33188,
      "new_path": "axis-rt-core/src/test/java/test/faults/TestFaultClassInstantiation.java"
    }
  ]
}