hanicz opened a new pull request, #1349: URL: https://github.com/apache/knox/pull/1349
…che Knox Admin API [KNOX-3418](https://issues.apache.org/jira/browse/KNOX-3418) - Path traversal → arbitrary file write/overwrite in the Apache Knox Admin API ## What changes were proposed in this pull request? 1. Path traversal in resource-management upload endpoints PUT `/admin/api/v1/{providerconfig,descriptors,topologies}/{name}` let an admin-role user write files outside the managed shared-providers/descriptors/topologies directories with an attacker-chosen name and extension (e.g. overwriting conf/gateway-site.xml). - `TopologiesResource` — tightened the pattern to ^[\w.-]+$ (no /), made `isValidResourceName` also reject any name containing `..`, removed the redundant `URLDecoder.decode` from all three handlers. - `DefaultTopologyService` — canonical-path containment guards at the `writeConfig` and `deployTopology` sinks. - `ZkRemoteConfigurationMonitorService` — `createProvider`/`createDescriptor` strip directory components via `FilenameUtils.getName()` before building the znode path. 2. Read-only topology override bypass Topologies marked read-only via `gateway.read.only.override.topologies` are blocked in the UI, but PUT `/admin/api/v1/topologies/{id}` never consulted that list — it only guarded against descriptor-generated topologies (`isGenerated()`), which read-only-override topologies are not. - `TopologiesResource.uploadTopology` — before deploying, refuse if the name is in `getReadOnlyOverrideTopologyNames(),` throwing 403 FORBIDDEN. New unit tests ## How was this patch tested? Tested Admin UI after the changes Unit tests Local admin API tests ``` <property> <name>gateway.read.only.override.topologies</name> <value>homepage</value> </property> ``` ``` curl -ivku admin:admin-password -H "Content-Type: application/xml" -d '<?xml version="1.0" encoding="UTF-8"?> <topology> <uri>https://localhost:8443/gateway/sandbox</uri> <name>sandbox</name> <timestamp>1579705815000</timestamp> <generated>false</generated> <redeployTime>0</redeployTime> <gateway> <provider> <role>identity-assertion</role> <name>Default</name> <enabled>true</enabled> </provider> </gateway> <service> <role>NAMENODE</role> <url>hdfs://localhost:8020</url> </service> </topology>' -X PUT 'https://localhost:8443/gateway/newmanager/api/v1/topologies/sandbox' ``` Before `HTTP/1.1 200 OK` After: ``` HTTP/1.1 403 Forbidden { "error" : "Cannot overwrite read-only topology: homepage" } ``` ``` curl -ivku admin:admin-password -H "Content-Type: application/json" -d "<configuration> ...your chosen content... </configuration>" -X PUT 'https://localhost:8443/gateway/newmanager/api/v1/providerconfig/..%252fgateway-site.xml' ERROR knox.gateway (TopologiesResource.java:uploadProviderConfiguration(334)) - Invalid resource name: ..%2fgateway-site.xml ``` ``` curl -ivku admin:admin-password -H "Content-Type: application/json" -d "<configuration> ...your chosen content... </configuration>" -X PUT 'https://localhost:8443/gateway/newmanager/api/v1/providerconfig/..%2fgateway-site.xml' ERROR knox.gateway (TopologiesResource.java:uploadProviderConfiguration(334)) - Invalid resource name: ../gateway-site.xml ``` ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
