IGNITE-28743 Block remote HTTP/HTTPS/FTP URLs in resolveSpringUrl prevent RCE via JDBC cfg:// - #13382

Open

animovscw wants to merge 44 commits into

apache:masterfrom

animovscw:ignite-28743-2

Commits on Jul 24, 2026

IGNITE-28743: Block remote HTTP/HTTPS/FTP URLs in resolveSpringUrl to prevent RCE via JDBC cfg://
animovscw
committed
2c8b71c
IGNITE-28743 Validate URL scheme in resolveSpringUrl
animovscw
committed
6359859
IGNITE-28743 Add jdbc tests
animovscw
committed
764048d
IGNITE-28743 Combine three tests into one
animovscw
committed
6698540
IGNITE-28743 Add a test that verifies that no security-exception is thrown when the flag is enabled
animovscw
committed
4806277
IGNITE-28743 Add JDBC end-to-end tests for remote cfg:// URL blocking
animovscw
committed
b586301
IGNITE-28743 Fix code style
animovscw
committed
2af3a6e
IGNITE-28743 Fix code style
animovscw
committed
ac366c0
Potential fix for pull request finding

animovscw
and
Copilot
committed
a479bf0
Copilot review suggestions
animovscw
committed
50e3d5e
IGNITE-28743 checkstyle
animovscw
committed
3ab4cfe
IGNITE-28743 checkstyle
animovscw
committed
b4e0d72
Potential fix for pull request finding

animovscw
and
Copilot
committed
600c6c9
IGNITE-28869 Potential fix for pull request finding
animovscw
committed
b2b3f26
IGNITE-28827 Move ftp validation before try
animovscw
committed
8eedf69
Update modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java

animovscw
and
zstan
authored
e9c4729
Update modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java

animovscw
and
zstan
authored
c42bd91
Update modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java

animovscw
and
zstan
authored
1aa536c
Update modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java

animovscw
and
zstan
authored
cb9eb9a
Review changes
animovscw
committed
d1f781d
Move the raw-string check into the catch block
animovscw
committed
fa23414

Commits on Aug 7, 2026

Merge branch 'master' into ignite-28743-2
animovscw
authored
9c1308a
IGNITE-28743: Block remote HTTP/HTTPS/FTP URLs in resolveSpringUrl to prevent RCE via JDBC cfg://
animovscw
committed
09b7a56
IGNITE-28743 Validate URL scheme in resolveSpringUrl
animovscw
committed
403ae70
IGNITE-28743 Add jdbc tests
animovscw
committed
bafd8b3
IGNITE-28743 Combine three tests into one
animovscw
committed
0845544
IGNITE-28743 Add a test that verifies that no security-exception is thrown when the flag is enabled
animovscw
committed
c6082e3
IGNITE-28743 Add JDBC end-to-end tests for remote cfg:// URL blocking
animovscw
committed
9e20bc4
IGNITE-28743 Fix code style
animovscw
committed
2d4b0b8
IGNITE-28743 Fix code style
animovscw
committed
d2a9525
Potential fix for pull request finding

animovscw
and
Copilot
committed
7e54ade
Copilot review suggestions
animovscw
committed
18c37de
IGNITE-28743 checkstyle
animovscw
committed
1adcd83
IGNITE-28743 checkstyle
animovscw
committed
3b3d0df
Potential fix for pull request finding

animovscw
and
Copilot
committed
4015bcd
IGNITE-28869 Potential fix for pull request finding
animovscw
committed
2feae06
IGNITE-28827 Move ftp validation before try
animovscw
committed
a1a9826
Update modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java

animovscw
and
zstan
committed
f5118fa
Update modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java

animovscw
and
zstan
committed
3c74d5a
Update modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java

animovscw
and
zstan
committed
d18bbff
Update modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java

animovscw
and
zstan
committed
15d63b6
Review changes
animovscw
committed
cdeea56
Move the raw-string check into the catch block
animovscw
committed
c5485b3
Merge remote-tracking branch 'origin/ignite-28743-2' into ignite-28743-2
animovscw
committed
e7ee415