[
https://issues.apache.org/jira/browse/KNOX-3418?focusedWorklogId=1035601&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1035601
]
ASF GitHub Bot logged work on KNOX-3418:
----------------------------------------
Author: ASF GitHub Bot
Created on: 13/Aug/26 13:37
Start Date: 13/Aug/26 13:37
Worklog Time Spent: 10m
Work Description: hanicz opened a new pull request, #1349:
URL: https://github.com/apache/knox/pull/1349
…che Knox Admin API
[KNOX-3418](https://issues.apache.org/jira/browse/KNOX-3418) - Path
traversal → arbitrary file write/overwrite in the Apache Knox Admin API
## What changes were proposed in this pull request?
1. Path traversal in resource-management upload endpoints
PUT `/admin/api/v1/{providerconfig,descriptors,topologies}/{name}` let an
admin-role user write files outside the managed
shared-providers/descriptors/topologies directories with an attacker-chosen
name and extension (e.g. overwriting conf/gateway-site.xml).
- `TopologiesResource` — tightened the pattern to ^[\w.-]+$ (no /), made
`isValidResourceName` also reject any name containing `..`, removed the
redundant `URLDecoder.decode` from all three handlers.
- `DefaultTopologyService` — canonical-path containment guards at the
`writeConfig` and `deployTopology` sinks.
- `ZkRemoteConfigurationMonitorService` —
`createProvider`/`createDescriptor` strip directory components via
`FilenameUtils.getName()` before building the znode path.
2. Read-only topology override bypass
Topologies marked read-only via `gateway.read.only.override.topologies` are
blocked in the UI, but PUT `/admin/api/v1/topologies/{id}` never consulted that
list — it only guarded against descriptor-generated topologies
(`isGenerated()`), which read-only-override topologies are not.
- `TopologiesResource.uploadTopology` — before deploying, refuse if the name
is in `getReadOnlyOverrideTopologyNames(),` throwing 403 FORBIDDEN.
New unit tests
## How was this patch tested?
Tested Admin UI after the changes
Unit tests
Local admin API tests
```
<property>
<name>gateway.read.only.override.topologies</name>
<value>homepage</value>
</property>
```
```
curl -ivku admin:admin-password -H "Content-Type: application/xml" -d '<?xml
version="1.0" encoding="UTF-8"?>
<topology>
<uri>https://localhost:8443/gateway/sandbox</uri>
<name>sandbox</name>
<timestamp>1579705815000</timestamp>
<generated>false</generated>
<redeployTime>0</redeployTime>
<gateway>
<provider>
<role>identity-assertion</role>
<name>Default</name>
<enabled>true</enabled>
</provider>
</gateway>
<service>
<role>NAMENODE</role>
<url>hdfs://localhost:8020</url>
</service>
</topology>' -X PUT
'https://localhost:8443/gateway/newmanager/api/v1/topologies/sandbox'
```
Before `HTTP/1.1 200 OK`
After:
```
HTTP/1.1 403 Forbidden
{ "error" : "Cannot overwrite read-only topology: homepage" }
```
```
curl -ivku admin:admin-password -H "Content-Type: application/json" -d
"<configuration> ...your chosen content... </configuration>" -X PUT
'https://localhost:8443/gateway/newmanager/api/v1/providerconfig/..%252fgateway-site.xml'
ERROR knox.gateway
(TopologiesResource.java:uploadProviderConfiguration(334)) - Invalid resource
name: ..%2fgateway-site.xml
```
```
curl -ivku admin:admin-password -H "Content-Type: application/json" -d
"<configuration> ...your chosen content... </configuration>" -X PUT
'https://localhost:8443/gateway/newmanager/api/v1/providerconfig/..%2fgateway-site.xml'
ERROR knox.gateway
(TopologiesResource.java:uploadProviderConfiguration(334)) - Invalid resource
name: ../gateway-site.xml
```
## Integration Tests
N/A
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1035601)
Remaining Estimate: 0h
Time Spent: 10m
> Path traversal → arbitrary file write/overwrite in the Apache Knox Admin API
> ----------------------------------------------------------------------------
>
> Key: KNOX-3418
> URL: https://issues.apache.org/jira/browse/KNOX-3418
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 2.1.0, 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Blocker
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Reported by greybtw
>
> Path traversal in the Knox Admin API resource-management endpoints (PUT
> /admin/api/v1/\{providerconfig,descriptors,topologies}/\{name}). The
> client-supplied resource name is URL-decoded and validated against
> RESOURCE_NAME_PATTERN = ^[\w-/.]+$, whose character class admits / and . (the
> - is literal), so a ../ traversal passes validation. The decoded name is then
> written via new File(dest, name) + FileUtils.writeStringToFile with no
> canonical-path containment check, so an authenticated admin-role user can
> write/overwrite a file outside the managed
> shared-providers/descriptors/topologies directories, with an attacker-chosen
> filename and extension (getFileNameForResource keeps the name verbatim when
> it already has a .)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
