Security implications of remote DataDictionary download

[philipwhiuk]

I had no idea the library would natively support HTTP download (and not HTTPS) inside the DataDictionary loader.

Is it worth documenting somewhere? I imagine most applications don't use the functionality and will want to safeguard against it by validating the resource isn't a URL.

quickfixj/quickfixj-base/src/main/java/quickfix/FileUtil.java

Line 150 in ac26cc9

if (urlConnection instanceof HttpURLConnection) {

[chrjohn]

@philipwhiuk , see #1247 , although I am not sure if we should allow to bypass it...

[philipwhiuk]

My point was really URLs at all rather than non-HTTP (that was just an extreme case).

[chrjohn]

@philipwhiuk any suggestions? Disable by default?