)]}'
{
  "commit": "52c7ba310fcaca1ff60d596d2b118d34851eb4b7",
  "tree": "5ea22ffa14f590c4c4afabafcbb8e74981aca213",
  "parents": [
    "1b6856b4d7903780786c79327bed1b53ea051a15"
  ],
  "author": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Wed Aug 05 07:48:02 2026 -1000"
  },
  "committer": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Wed Aug 05 07:48:02 2026 -1000"
  },
  "message": "Also gate the response endpoint where the transport is acquired\n\nCorrects a claim I had made: CXF does not check at the inbound-parsing layer.\nIts check sits in DecoupledDestination.getBackChannel -- the method that hands\nback the conduit for a decoupled response -- so anything reaching for that\nback channel is screened however the endpoint reference arrived. Checking only\nin AddressingInHandler was weaker, and the report\u0027s proof-of-concept showed\nit: it builds\na MessageContext, calls setReplyTo directly and drives the transport sender,\nnever passing through header parsing, and the server still connected out.\n\nMessageContextBuilder.setupCorrectTransportOut is the Axis2 analogue. It runs\nonly for a server-side response to a non-anonymous, non-none destination, and\nit is where that destination\u0027s transport is resolved -- the same depth as CXF\u0027s\ncheck. The policy therefore moves to the kernel org.apache.axis2.addressing\npackage, beside EndpointReference and AddressingFaultsHelper, so both the\nhandler and the kernel can use it. The handler check stays: it faults early\nwith a proper wsa fault on the path a remote caller actually has.\n\nThe PoC now fails on both its positive cases. The resolver pool shutdown moves\nfrom the addressing module to AxisConfiguration.cleanup(), next to the\nmultipart reaper, since the policy is no longer module-scoped.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "63dbbaefbe25604d571af9211e343e04cd80d89a",
      "old_mode": 33188,
      "old_path": "modules/addressing/src/org/apache/axis2/handlers/addressing/Addressing.java",
      "new_id": "047e8e1be62203ebf4797d95c8d14d7558ea8ae7",
      "new_mode": 33188,
      "new_path": "modules/addressing/src/org/apache/axis2/handlers/addressing/Addressing.java"
    },
    {
      "type": "modify",
      "old_id": "1c6ffc15478fa9114ebbbcedd650c8641bba1167",
      "old_mode": 33188,
      "old_path": "modules/addressing/src/org/apache/axis2/handlers/addressing/AddressingInHandler.java",
      "new_id": "8b64481476bdc4de5aa68031dc5e3d9ef9f27d69",
      "new_mode": 33188,
      "new_path": "modules/addressing/src/org/apache/axis2/handlers/addressing/AddressingInHandler.java"
    },
    {
      "type": "modify",
      "old_id": "970294cf6b13ea1334557cc5680edcb13409efc2",
      "old_mode": 33188,
      "old_path": "modules/addressing/test/org/apache/axis2/handlers/addressing/ResponseEndpointPolicyHandlerTest.java",
      "new_id": "8a2cbe38104b5999e873c4ff9ae8dcbe5b536428",
      "new_mode": 33188,
      "new_path": "modules/addressing/test/org/apache/axis2/handlers/addressing/ResponseEndpointPolicyHandlerTest.java"
    },
    {
      "type": "rename",
      "old_id": "83fcfa058d526a68bbbd61709ba88933214c6c03",
      "old_mode": 33188,
      "old_path": "modules/addressing/src/org/apache/axis2/handlers/addressing/ResponseEndpointPolicy.java",
      "new_id": "6aab3227a8c68c0486dc3ba72b132e39adb9d1cf",
      "new_mode": 33188,
      "new_path": "modules/kernel/src/org/apache/axis2/addressing/ResponseEndpointPolicy.java",
      "score": 96
    },
    {
      "type": "modify",
      "old_id": "fd2d8e46060448c3358531c8cf99e73f3d7c2d3f",
      "old_mode": 33188,
      "old_path": "modules/kernel/src/org/apache/axis2/engine/AxisConfiguration.java",
      "new_id": "a0dc32ac12ae4b3398f1684b8ebebc823cca9765",
      "new_mode": 33188,
      "new_path": "modules/kernel/src/org/apache/axis2/engine/AxisConfiguration.java"
    },
    {
      "type": "modify",
      "old_id": "9bf82f965cceecfca8f4b170a198844ed57f9a68",
      "old_mode": 33188,
      "old_path": "modules/kernel/src/org/apache/axis2/util/MessageContextBuilder.java",
      "new_id": "91a3f786f24a50ce2f7ca3ff9210d2da9958d1cf",
      "new_mode": 33188,
      "new_path": "modules/kernel/src/org/apache/axis2/util/MessageContextBuilder.java"
    },
    {
      "type": "rename",
      "old_id": "478d0acdf81bb6bdccf337d5344a5374465846af",
      "old_mode": 33188,
      "old_path": "modules/addressing/test/org/apache/axis2/handlers/addressing/ResponseEndpointPolicyTest.java",
      "new_id": "d672157d5ca20d5df3b6ed4c19f0bd049abb50d3",
      "new_mode": 33188,
      "new_path": "modules/kernel/test/org/apache/axis2/addressing/ResponseEndpointPolicyTest.java",
      "score": 98
    }
  ]
}