oscerd opened a new pull request, #25578:
URL: https://github.com/apache/camel/pull/25578

   Fixes [CAMEL-24412](https://issues.apache.org/jira/browse/CAMEL-24412).
   
   ## Problem
   
   `HttpServerChannelHandler.extractTarget()` strips the endpoint context-path 
so the security constraint is evaluated relative to the endpoint. The strip was 
guarded by a **case-sensitive** `startsWith`:
   
   ```java
   if (path != null && target.startsWith(path)) {
       // need to match by lower case as we want to ignore case on context-path
       path = path.toLowerCase(Locale.US);
       String match = target.toLowerCase(Locale.US);
       if (match.startsWith(path)) {
           target = target.substring(path.length());
       }
   }
   ```
   
   The inner case-insensitive comparison can never change the outcome — it is 
**dead code**. A request whose context-path differs only by case is evaluated 
against the *unstripped* target.
   
   Dispatch does not share that property: 
`RestConsumerContextPathMatcher.matchPath()` compares with `equalsIgnoreCase` 
and a lower-cased prefix, so the request still reaches the route. Authorization 
and dispatch disagreed about which endpoint a request belongs to.
   
   With `matchOnUriPrefix=true` and a `securityConstraint` whose inclusions are 
**specific sub-paths rather than a catch-all**, the miscased target matches no 
inclusion — and in `SecurityConstraintMapping`, an unmatched target counts as 
*unrestricted*.
   
   ## Change
   
   The strip uses the case-insensitive comparison directly, so the constraint 
sees the same normalized target the request is routed to.
   
   ## Tests
   
   `NettyHttpBasicAuthConstraintCaseInsensitiveTest` covers both directions 
against a constraint with a specific `/admin/*` inclusion:
   
   | Request | Before | After |
   |---|---|---|
   | `GET /foo/admin/x` (no credentials) | 401 | 401 |
   | `GET /Foo/admin/x` (no credentials) | **200 — route reached, constraint 
skipped** | 401 |
   
   Verified by reverting the fix: `differentlyCasedContextPathIsChallengedToo` 
fails with *"Expected CamelExecutionException to be thrown, but nothing was 
thrown"*.
   
   ```
   mvn test -Dtest=NettyHttpBasicAuthConstraintCaseInsensitiveTest   # 2 passed
   mvn clean install -DskipTests                                     # full 
reactor, BUILD SUCCESS
   ```
   
   Note the existing `NettyHttpBasicAuthConstraintMapperTest` uses a catch-all 
`/*` inclusion, which is why it never surfaced this — with a catch-all the 
miscased path still matches and is challenged.
   
   ## Backport
   
   Intended for **camel-4.22.x, camel-4.18.x and camel-4.14.x**: it restores 
the intended behaviour of an existing control, adds no option and changes no 
API. Deployments relying on reaching a route without a challenge via a miscased 
path will now receive 401 — covered by the upgrade-guide entry on `main`.
   
   ---
   _Claude Code on behalf of 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to