In AbstractReferenceFinderImpl, if the locator.getSystemId() returns a "jar:" based URL that contains a "!", it will blindly append the value returned from findExternalResource to the "jar" url. However, if the value returned from findExternalResource is already a full absolute URL, that would result in an invalid URL.
In AbstractReferenceFinderImpl, if the locator.getSystemId() returns a "jar:" based URL that contains a "!", it will blindly append the value returned from findExternalResource to the "jar" url. However, if the value returned from findExternalResource is already a full absolute URL, that would result in an invalid URL.
As an example, if the systemId is something like:
jar:file:/Users/dkulp/.m2/repository/de/dekies/cxf4564/api/1.0.0-SNAPSHOT/api-1.0.0-SNAPSHOT.jar!/wsdl/xsd/my-service.xsd
and the findExternalResource returns a fully resolved URL like:
jar:file:/Users/dkulp/.m2/repository/de/dekies/cxf4564/api/1.0.0-SNAPSHOT/api-1.0.0-SNAPSHOT.jar!/wsdl/xsd/iso-country-codes.xsd
the resulting URL passed to parse is:
jar:file:/Users/dkulp/.m2/repository/de/dekies/cxf4564/api/1.0.0-SNAPSHOT/api-1.0.0-SNAPSHOT.jar!jar:file:/Users/dkulp/.m2/repository/de/dekies/cxf4564/api/1.0.0-SNAPSHOT/api-1.0.0-SNAPSHOT.jar!/wsdl/xsd/iso-country-codes.xsd
which is then not valid. Note that if findExternalResource returns a full "http" URL, a similar problem occurs.
Affected Versions
[2.2.6]