[kali834x]

the four RESTUtil entry points (processURLRequest and processXMLRequest, both overloads) now refuse a request whose content type is not application/json when enableJSONOnly is set, using the check HTTPTransportUtils.processHTTPPostRequest already applies to POST. those are the paths behind AxisServlet.doGet/doPut/doDelete and the standalone HTTPWorker's GET, PUT, DELETE and xml- or form-typed POST, and none of them read the parameter, so on a JSON-only deployment (the spring boot starter's axis2-json.xml, which also sets disableREST=false) GET /axis2/services//?= was dispatched by request URI, XFormURLEncodedBuilder bound the arguments from the query string and JsonRpcMessageReceiver invoked the operation through its RPCMessageReceiver fallback; a PUT with an application/xml body did the same through ApplicationXMLBuilder. json-springboot-userguide documents enableJSONOnly as rejecting any request without Content-Type: application/json and disabling the XML formats, and a cross-site GET is a simple request with no CORS preflight, so for a cookie-authenticated service that requirement did not hold (CWE-693, CWE-352). the check sits in RESTUtil rather than AxisServlet so the standalone transport is covered by the same code, and a refused request takes the existing fault path (400 with the JSON-only error body on the servlet, the same fault the standalone server already returns for a non-JSON POST). JSON requests and the metadata routes (?wsdl, ?xsd, the listing) are unchanged; a JSON-only deployment that relied on plain GET/PUT/DELETE now has to send the JSON content type, which the 2.0.3 release notes record. AxisServletJSONOnlyTest gains a case that fails before the change (GET and PUT both reach the operation's receiver) and passes after. an Axis2Server run with a Moshi JsonRpcMessageReceiver POJO under enableJSONOnly=true answered "Hello Mallory" to GET .../sayHello?name=Mallory and invoked the method for POST application/xml, PUT and DELETE before the change, and refuses all four after while the JSON POST still returns 200. transport-http (115 tests), json (163), openapi, transport-h2 and spring-boot-starter verify green with -Papache-release.