oscerd opened a new pull request, #143:
URL: https://github.com/apache/camel-kit/pull/143
Closes #137.
`IndexDownloader` fetches the index manifest (`index.json`) and the archive
it points to. The manifest carries the `sha256` used to verify the archive, so
if the **manifest** is fetched over cleartext `http` a man-in-the-middle can
rewrite both the asset URL and its expected hash — the integrity check then
verifies attacker content against an attacker-supplied hash.
This adds a single `requireFetchableUri()` check:
- `https` and local `file` URIs are allowed anywhere;
- `http` is allowed **only to a loopback host** (`localhost`, `127.0.0.0/8`,
`::1`) — no network attacker, and it keeps local testing (and the loopback HTTP
test fixtures) working;
- any other scheme is rejected.
It is applied at every remote entry point: the operator-configured manifest
URL (`knowledge.index.url`), the release-discovery endpoint
(`knowledge.index.releases-url`), the discovered release-asset manifest URL,
and the resolved asset URL. This replaces the previous `{https, http, file}`
allowlist that accepted cleartext `http` to any host.
The default configuration (HTTPS GitHub releases) is unaffected.
Defense-in-depth; not exploitable in the default setup.
Tested: `IndexDownloaderTest` (62, incl. a new
`nonLoopbackHttpManifestIsRejected`) and `IndexDownloaderTimeoutTest` (10)
pass; `-Psourcecheck validate` clean.
_AI-generated by Claude Code (Claude Opus 4.8) on behalf of @oscerd._
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
