)]}'
{
  "commit": "6bdd6a07eaba04496730b95bb6c34bcb9434e496",
  "tree": "28e42d7bbbd743126ba0e193044f1827ba1321d0",
  "parents": [
    "25db09b07bc206049717e52126009af2a7dfe597"
  ],
  "author": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Fri Sep 04 13:09:41 2026 -1000"
  },
  "committer": {
    "name": "Robert Lazarski",
    "email": "robertlazarski@gmail.com",
    "time": "Fri Sep 04 13:09:41 2026 -1000"
  },
  "message": "Screen every WSDL-loading path, not just the client-side one\n\nwsdl4j parses with its own unhardened parser and fetches the import chain\nitself, so a DOCTYPE anywhere in a WSDL was an XXE in whichever JVM read it.\nSecureWSDLLocator screened only createClientSideAxisService, and it fetches\nover http/https alone, so it cannot serve the paths that load from a file, an\narchive, the classpath or a catalog. HardenedWSDLLocator separates screening\nfrom resolution: a delegate locator keeps its own catalog or archive behaviour\nand only its bytes are screened, and a bare relative path still loads, which is\nwhat wsdl4j accepts and what codegen passes. Wired into the JAX-WS loader, the\nruntime reload wrapper, the deployment builder\u0027s resolver path and WSDL2Java.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "1feeae5d1b45e4236367d504c27bda4e8f81ece5",
      "old_mode": 33188,
      "old_path": "SECURITY.md",
      "new_id": "7d0f12375088e05549db46a151cd3b5fbe73f720",
      "new_mode": 33188,
      "new_path": "SECURITY.md"
    },
    {
      "type": "modify",
      "old_id": "b824977971ddd24ff6a4cf0136fdd87d519aa89a",
      "old_mode": 33188,
      "old_path": "modules/codegen/src/org/apache/axis2/wsdl/codegen/CodeGenConfiguration.java",
      "new_id": "05c5bf8f1b4348b70614147cd938d9a843a398dd",
      "new_mode": 33188,
      "new_path": "modules/codegen/src/org/apache/axis2/wsdl/codegen/CodeGenConfiguration.java"
    },
    {
      "type": "modify",
      "old_id": "7a8eb37e27b6bd234b7c37720f78aebdf20645f7",
      "old_mode": 33188,
      "old_path": "modules/kernel/src/org/apache/axis2/description/WSDL11ToAxisServiceBuilder.java",
      "new_id": "19a0bfdcf855fd5c2193bd8b0e9f103c5d8e9451",
      "new_mode": 33188,
      "new_path": "modules/kernel/src/org/apache/axis2/description/WSDL11ToAxisServiceBuilder.java"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "a18b0c1df1b827cf39703ae2c609546b512db9e7",
      "new_mode": 33188,
      "new_path": "modules/kernel/src/org/apache/axis2/util/HardenedWSDLLocator.java"
    },
    {
      "type": "modify",
      "old_id": "5b9c4eb57174d2cd79598f304a5f0c0a186ef66d",
      "old_mode": 33188,
      "old_path": "modules/kernel/src/org/apache/axis2/wsdl/util/WSDLWrapperReloadImpl.java",
      "new_id": "496a9c5d1d83795752eb32c28dc7215ca405d524",
      "new_mode": 33188,
      "new_path": "modules/kernel/src/org/apache/axis2/wsdl/util/WSDLWrapperReloadImpl.java"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "b1a3ebf2d4fcae8ebbcb118dcc13ec8e8be05117",
      "new_mode": 33188,
      "new_path": "modules/kernel/test/org/apache/axis2/util/HardenedWSDLLocatorTest.java"
    },
    {
      "type": "modify",
      "old_id": "24b9cf2fb3a2a61b1a0573f4e6203c7e4d54b61a",
      "old_mode": 33188,
      "old_path": "modules/metadata/src/org/apache/axis2/jaxws/util/WSDL4JWrapper.java",
      "new_id": "c111aa9a1be2212d296c26fd7e4f0cf424fd05b1",
      "new_mode": 33188,
      "new_path": "modules/metadata/src/org/apache/axis2/jaxws/util/WSDL4JWrapper.java"
    },
    {
      "type": "modify",
      "old_id": "84f2e6751aa518819ae9a714b41ee098d75414f4",
      "old_mode": 33188,
      "old_path": "src/site/markdown/release-notes/2.0.2.md",
      "new_id": "0dab023f846ebfbd8a1aad9b54ae59ae32703145",
      "new_mode": 33188,
      "new_path": "src/site/markdown/release-notes/2.0.2.md"
    }
  ]
}